Unauthenticated SQL injection in QCMS through 6.0.6 allows remote attackers to inject arbitrary SQL through the ID argument processed by the self_Tmp function in Lib/Config/Controllers.php, reachable via the public Content Detail Page. No authentication or user interaction is required (CVSS vector PR:N/UI:N), and publicly available exploit code exists - a proof-of-concept write-up has been published in a public GitHub issue. Exploitation is moderated in practice by the application's router, which parses the raw REQUEST_URI without URL-decoding, so payloads must contain literal space characters; percent-encoded (%20) payloads never decode before route parsing and fail, which gives edge proxies, CDNs and WAFs a usable filtering point. This is a moderate-priority issue against an obscure PHP CMS whose vendor has not issued a fix and has responded to the reporter with hostility.
SQL injection in the Drogon C++ web framework's ORM layer (Mapper::orderBy in Mapper.h, versions through 1.9.13) lets a remote, unauthenticated attacker inject arbitrary SQL through the sort argument of a list or search endpoint. The flaw is a library defect rather than a default-on endpoint: it is only reachable when application code forwards attacker-controlled input into orderBy, so applications that hardcode or whitelist sort columns are not exploitable. Publicly available exploit code exists (a public gist referenced by the disclosure), and the vendor did not respond to the report; no CISA KEV entry is associated with this CVE, and the realistic impact is high-confidentiality, limited-integrity data exposure rather than direct code execution.
Authenticated OpenStack project members can inject arbitrary HAProxy configuration directives - and from there achieve code execution on Amphora load-balancer instances - by embedding newline characters in the tls_ciphers field of a TLS-enabled listener or pool in OpenStack Octavia before 18.0.1. The value is written verbatim into the HAProxy configuration generated on the amphora, so a crafted cipher string breaks out of the intended directive and appends attacker-controlled configuration (CWE-94). Only deployments using the Amphora provider driver are affected; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), though the assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting high confidentiality, integrity, and availability impact that extends beyond the vulnerable component to the amphora instance itself.
Authenticated OpenStack project members who own a load balancer can inject arbitrary HAProxy directives into the amphora configuration produced by Octavia before 18.0.1, because the Amphora provider driver fails to reject control characters in L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, so newline-bearing payloads pass structural checks, but the raw value is stored and written verbatim into the generated HAProxy config - yielding code/directive injection with high confidentiality, integrity, and availability impact on the amphora and the traffic it proxies. Exploitation requires valid tenant credentials plus ownership of a load balancer (CVSS PR:L, unauthenticated paths do not exist), and only Amphora-provider deployments are affected; OVN and other Octavia providers are explicitly immune. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the assessment rates it a genuine high-priority problem rather than an inflated score.
Tinyauth versions prior to 5.1.0 can be forced into a temporary, instance-wide login lockdown by an unauthenticated remote attacker who sends POST /api/user/login requests using 257 distinct nonexistent usernames, filling the MaxLoginAttemptRecords limit so that legitimate users receive HTTP 429 responses until the default auth.loginTimeout of roughly 300 seconds elapses. The flaw is an availability-only, low-severity issue (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; CWE-307) that grants no confidentiality or integrity access and does not invalidate or degrade existing authenticated sessions; the attacker gains nothing beyond the temporary denial of new logins and must repeat the request burst to sustain it. No public exploit code was identified at time of analysis, and there is no evidence of active exploitation (not in CISA KEV); deployments that have disabled lockdown mode are unaffected. The issue is fixed in Tinyauth 5.1.0.
Sync-in Server versions prior to 2.4.1 leak account existence through a timing side channel in the login endpoint, allowing unauthenticated remote attackers to enumerate valid usernames or email addresses. The issue arises because login attempts for nonexistent accounts return early without running the bcrypt comparison performed for real accounts, producing a measurable difference in response times. This is a low-severity information-disclosure weakness (CVSS 5.3) that reveals only whether an account is registered, but can be chained into credential-stuffing, password-spraying, or phishing attacks; no public exploit identified at time of analysis.
Authenticated low-privileged users of jshERP through 3.6 can overwrite role button-permission definitions for any role in their tenant by sending arbitrary roleId and btnStr values to the POST /userBusiness/updateBtnStr endpoint, because that handler performs no authorization check on the caller's privileges. Publicly available exploit code exists (a Python POC script is published on GitHub) and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L reflects moderate impact confined to the integrity and availability of permission configuration with no confidentiality exposure; the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation.
Authenticated tenant isolation bypass in jshERP through 3.6 allows any logged-in user to read other tenants' records from the GET /tenant/info endpoint by iterating tenant primary keys, exposing login names, validity dates, user quotas, and enabled state for every tenant on the platform. Exploitation requires only a valid account of any privilege level (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) and publicly available exploit code exists, though CISA KEV does not list this CVE as actively exploited. Impact is a bounded confidentiality leak - CVSS 5.0 with changed scope but no integrity or availability effect - and only materializes on instances that are genuinely multi-tenant with other tenants' records present; a single-tenant deployment exposes nothing beyond the caller's own data.
Authenticated users of lamp-cloud through 5.10.0 can read any other employee's role codes, permission codes, and full front-end router tree by supplying arbitrary employeeId values to the /anyone/visible/resource endpoint, which never verifies that the requested identifier belongs to the caller. Exploitation is trivial - any low-privilege account suffices, the identifiers appear to be enumerable integers, no user interaction or elevated privilege is required, and publicly available exploit code exists (a Python PoC targeting this exact BOLA condition). The flaw is confirmed as an object-level authorization failure (CWE-639) and is not known to be actively exploited (no CISA KEV listing); impact is limited to read-only disclosure of authorization metadata, which matches the assessed CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Stack-based buffer overflow in Fluent Bit's out_forward Secure Forward plugin (versions 0.11.0 through releases prior to 5.0.8) lets an attacker who controls or can impersonate the configured forwarding destination overwrite stack memory while Fluent Bit processes the handshake PONG response. The vulnerable path is only reachable when the out_forward output plugin is configured in Secure Forward mode with Shared_Key or Empty_Shared_Key - not the default output configuration - and the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) plus the independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) both characterize it as an unauthenticated network attack that depends on specific deployment preconditions. Impact ranges from reliable process termination on builds compiled with a stack canary to full remote code execution as the Fluent Bit process user on builds lacking canary protection or where a memory-disclosure primitive exists; the opt-in --supervisor mode with fork-only respawns further weakens hardened builds by preserving canary and address layout across restarts. No public exploit code has been identified at time of analysis, and the issue is fixed in version 5.0.8.
A heap-based buffer overflow (CWE-122) in the IOCTL handler (sub_140001000) of mtdispkm64.sys, the kernel-mode display driver shipped with the Moore Threads MTT S80 GPU driver package up to version 340.150, lets a local low-privileged user who can open a handle to the driver's device object supply a malformed IOCTL request and corrupt kernel pool memory, potentially achieving elevation to SYSTEM. The flaw is not remotely reachable (AV:L, PR:L per the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, rated 9.3), and exploitation is confined to Windows hosts that actually have this niche GPU driver installed and loaded. There is no vendor patch because Moore Threads did not respond to the disclosure, and no public exploit code has been identified at time of analysis.
Authenticated workspace members on MaxKB deployments prior to 2.10.5-lts can escalate to root-level command execution by abusing how the AWS Bedrock provider stores credentials. Because MaxKB writes user-supplied access_key_id and secret_access_key values into /root/.aws/credentials without proper parsing, an attacker can smuggle control characters and a forged [profile] block containing a credential_process directive, then trigger a later model-validation request that makes botocore run an attacker-controlled command as root. Exploitation requires valid workspace credentials, the reachable Bedrock provider configuration path, and a two-step inject-then-trigger sequence on a service running with root privileges; vendor-released patch 2.10.5-lts is available and no public exploit identified at time of analysis.
Server-side request forgery in CuteNews 2.1.2 (core/modules/media.php, the Media Manager 'Upload by URL' handler upload_from_inet) lets an attacker submit a crafted URL that the PHP backend fetches on the attacker's behalf, exposing internal-only services and cloud instance metadata endpoints to server-side retrieval. Our independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N rather than the published 9.1, because the Media Manager panel is a post-login feature, so a valid account is the practical prerequisite even though the published vector lists PR:N; realized impact further depends on internal network reachability and on whether the fetched response is returned or stored where the attacker can read it (blind SSRF only allows probing). No public exploit code or KEV-listed active exploitation was identified at time of analysis, and EPSS is very low at 0.15% (5th percentile), so this is a high-CVSS-but-modest-real-risk issue.
Code execution with access to GCP, AWS, and Snowflake credentials is possible in Feast's own CI pipeline prior to version 0.65.0, because the pr_integration_tests.yml workflow uses pull_request_target together with the synchronize event and preserves ok-to-test, approved, or lgtm labels on newly pushed commits. A fork contributor can get maintainer approval for a benign revision and then push altered commits that are checked out from refs/pull/${{ github.event.pull_request.number }}/merge and run through privileged make targets, resulting in runner code execution, credential disclosure, and possible access to downstream cloud resources; the CVSS vector indicates the attacker needs only a low-privilege GitHub identity (PR:L) plus a maintainer's approval action (UI:P), and no public exploit code was identified at the time of analysis. This is a CI/CD pipeline misconfiguration in the upstream feast-dev/feast repository rather than a flaw in deployed Feast installations, and it is fixed in 0.65.0.
Heap-based buffer overflow in X.Org libXrender before 0.9.13 allows a malicious or compromised X server to inject and execute arbitrary code in attached X11 clients via a crafted response to the RenderQueryPictFormats request. This is a reverse-direction attack where the victim must actively connect a vulnerable X11 client (linked against libXrender < 0.9.13) to an attacker-controlled or hijacked X server - typical exposure is via SSH X11 forwarding to an untrusted host or a remote DISPLAY connection; local trusted X servers are not affected. No public exploit code has been identified at time of analysis, and exploitation is non-trivial (AC:H) with no attacker authentication required (PR:N), but an upstream fix is available and the CVE description identifies 0.9.13 as the fixed version boundary.
Persistent root command execution in luci-app-adblock-fast prior to 1.2.4-2 on OpenWrt: an authenticated LuCI user who has been granted the component's write ACL can abuse the luci.adblock-fast.setCronEntry RPC by embedding carriage-return or line-feed characters in the entry argument. Because the value is serialized into /etc/crontabs/root as if it were a single line, the delegated user can create an additional physical cron entry that runs as UID 0 when cron executes. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) is directionally sound but materially gated by the mandatory pre-existing luci-app-adblock-fast write ACL and by cron actually running; exploitation is not demonstrated for unauthenticated users or users lacking that ACL. No public exploit identified at time of analysis, and the vendor fix is 1.2.4-2.
Shell command injection in KubeEdge's v1alpha2 NodeUpgradeJob upgrade workflow allows an authenticated user who holds RBAC permission to create or update NodeUpgradeJob resources to run arbitrary commands on targeted edge nodes with the privileges of the edge upgrade process. Affected deployments are those running KubeEdge 1.12.0 through 1.21.1, 1.22.0/1.22.1, or 1.23.0 that actually process node-upgrade tasks; the vulnerability is high-priority and genuine rather than a CVSS-inflated finding, but it is gated on the NodeUpgradeJob create/update privilege (PR:L, not anonymous) so it is not reachable by unauthenticated users or on clusters that do not grant that permission. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS/KEV data were not supplied for this CVE. Vendor-released patches exist in 1.21.2, 1.22.2, and 1.23.1.
Authenticated command injection in KubeEdge (1.21.0 up to 1.21.2, 1.22.2, and 1.23.1) lets a principal holding Kubernetes RBAC rights to create or modify ConfigUpdateJob resources inject shell metacharacters into the updateFields passed to the keadm config-update command, which the edge taskmanager then runs through a system shell, yielding arbitrary command execution on the enrolled target edge node with the privileges of the KubeEdge process. The vendor rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and our independent assessment is slightly more severe because compromise of the node process is a scope change (S:C); the PR:L vector confirms the attacker must be authenticated and authorized, so this is not anonymous or remotely unauthenticated abuse. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the flaw is a genuine, actionable CWE-78 issue rather than an inflated score, and it is fixed in KubeEdge 1.21.2, 1.22.2, and 1.23.1.
Authenticated delegated LuCI sessions that hold the luci-app-advanced-reboot read ACL can execute arbitrary commands as root on affected OpenWrt routers, because that read ACL grants rpcd file.exec permission for the general shell interpreter /bin/sh and passes caller-controlled parameters to it. Only builds that actually ship this /bin/sh exec grant prior to version 1.1.2-6 are vulnerable; the vendor explicitly states the checked openwrt-24.10 and openwrt-23.05 branches do not carry the grant and are not affected by this chain. Exploitation requires a valid low-privilege delegated rpcd/LuCI session (CVSS vector PR:L, no unauthenticated path), and no public exploit code was identified at time of analysis; the issue is fixed in 1.1.2-6.
Conda versions prior to 26.5.2 will follow an unvalidated entry-point command from a noarch:python package's info/link.json and write the generated executable wrapper to a path that can escape the installation prefix or overwrite a different in-prefix entry point, a classic CWE-22 path traversal in the package installation workflow. The victim must install the malicious package themselves (UI:R) and the resulting code runs with the installing user's privileges rather than elevated rights; the out-of-prefix variant additionally requires the destination parent directory to already exist, while the overwritten-entry-point variant only detonates when that entry point is later invoked. CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and no public exploit has been identified at time of analysis.
OS command injection in ntopng prior to 6.7.260717 allows an authenticated non-administrator user to run arbitrary operating-system commands as the ntopng process account, because the vulnerability-scan REST endpoints accepted the scan_ports parameter without an administrator check and passed it through a validator that still permits shell metacharacters. Exploitation requires nmap to be present on the host, and a secondary no-credentials path exists: the affected endpoints accept GET requests while ntopng's CSRF validation only covers POST bodies, so a logged-in victim's browser can be induced to trigger the command. The vulnerability is rated CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code or KEV-listed active exploitation was identified at time of analysis, and the issue is fixed in 6.7.260717.
A crafted, attacker-controlled serialized graph payload processed by FalkorDB 4.20.1 through 4.20.4 overflows a buffer in the GraphBLAS matrix decoder (_Decode_GrB_Matrix in /v19/decode_matrix.c), crashing the Redis module process and denying service to the instance. Reaching the flaw requires an authenticated network connection to the FalkorDB/Redis port (CVSS PR:L) plus the ability to submit matrix data into the decode/restore path; no user interaction is needed, and the confirmed outcome is a process-crash DoS rather than code execution or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-published CVSS 8.8 (C:H/I:H/A:H) overstates impact relative to the availability-only assessment.
Authenticated non-administrator users of ntopng prior to 6.7.260718 can list and download complete system-configuration backups through the REST v2 endpoints get/system/configurations/list_available_backups.lua and download_backup.lua, which lack the administrator authorization check that the vendor's fix adds. Because the backup payload includes the ntopng.user.* Redis key space, the downloaded archive routinely discloses local-user password hashes and, on deployments where those features are configured, API tokens, TOTP secrets and WebAuthn credential material - enabling account takeover via usable or crackable credentials. Exploitation requires only a valid low-privileged login (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment, PR:L means authenticated but not administrative), with no user interaction and no non-default configuration; no public exploit code or active-exploitation activity (CISA KEV) was identified at time of analysis. The vendor's own CVSS of 8.8 with I:H/A:H is judged slightly overstated, since the flaw is an information-disclosure primitive rather than direct integrity or availability loss.
Authenticated remote code execution affects the Jazzware RT1000 Edge webUI version 20.0.1, where the upgrade-package upload feature accepts server-side executable files and stores them in a web-accessible, executable directory that can be invoked directly over HTTP without authentication. An attacker who already holds valid webUI credentials (CVSS vector PR:L) can reach the upload function, place a malicious executable, and trigger it remotely, yielding full compromise of confidentiality, integrity, and availability (CVSS 8.8). Exploitation status: no public exploit identified at time of analysis; the CVE is not in CISA KEV, and EPSS is low at 0.24% (16th percentile), reflecting the niche target and the credential prerequisite rather than weak impact.
Unauthenticated remote denial of service in github.com/temporalio/tchannel-go (the Go implementation of the TChannel RPC protocol) before v1.22.1 lets any network peer that can complete the standard TChannel initialization handshake crash the hosting process. A crafted call fragment that carries checksum metadata but contains no length-prefixed argument chunks leaves the fragment reader's chunk slice empty, and the unconditional selection of the first element triggers an unrecovered Go slice-bounds panic on a library-created dispatch goroutine, terminating the process. There is no confidentiality or integrity impact, exploitation requires network reachability to a TChannel listener exposed to untrusted peers, and no public exploit code was identified at time of analysis (not confirmed actively exploited / not in CISA KEV); the assessed CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Denial of service in Temporal Server stems from uncontrolled recursion (CWE-674) in the bundled temporalio/sqlparser library: SQL containing deeply nested unary expressions is accepted and produces a correspondingly deep abstract syntax tree, and the library's recursive String and Walk traversals then exhaust the Go stack and abort the process in a way that Go panic recovery cannot contain. Affected are Temporal Server deployments prior to v1.30.7 and v1.31.3 that pass caller-controlled query text to the parser through the archival, visibility, and worker-query paths, including validation code that recursively formats an invalid expression while constructing an error. Exploitation requires an authenticated caller holding namespace read permission (the published CVSS 4.0 vector lists PR:N, but the reported prerequisites specify an authenticated caller and the independent assessment scores PR:L), the dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat, and repeated requests can sustain the outage; impact is availability-only and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network peers that can reach a live Ringpop TChannel/SWIM gossip listener can drive memory and gossip-bandwidth exhaustion in github.com/temporalio/ringpop-go, because peer-supplied label maps are retained and re-disseminated without being checked against the application's configured LabelOptions limits. Applications that use ringpop's label feature are affected; repeated membership changes for distinct member addresses carrying oversized label keys, values, or counts inflate the member list and propagate to the whole cluster, degrading and potentially taking down the hosting process (availability only, no confidentiality or integrity impact). Exploitation requires network reachability to the gossip/TChannel port - typically an internal cluster interface - and there is no public exploit identified at time of analysis, though the assessed severity (CVSS 3.1 base 8.7, PR:N, A:H) makes the exposure of that port the decisive risk factor.
Remote denial of service in temporalio/tchannel-go allows any network peer that can reach a TChannel listener to crash the hosting process: after completing the standard TChannel initialization handshake, the peer sends a call frame whose one-byte checksum-type field carries an unsupported value, which the parser uses directly as an index into a four-entry checksum pool and thereby triggers an unrecovered Go panic on the connection's read goroutine. Only availability is affected (the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H with no confidentiality or integrity impact), and exploitation is unauthenticated with no user interaction, requiring only that a TChannel listener be reachable by untrusted or multi-tenant peers rather than confined to a trusted internal mesh. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; a vendor patch is available and the issue is fixed in v1.22.1 (PR #14), so priority is driven almost entirely by listener exposure.
OS command injection in Dassault Systèmes Tuleap Enterprise Edition versions 17.3 through 17.5 allows an authenticated remote attacker with a low-privilege account to execute arbitrary operating system commands on the server, as indicated by CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and a base score of 8.8. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the potential for full server compromise makes this a genuine high-priority issue that is not a drop-everything emergency. Instances are only affected if they run versions 17.3-17.5 and permit low-privilege authenticated access, so environments with tightly controlled account provisioning or network restrictions face reduced exposure.
Authenticated callers holding only a write role in a single namespace can execute arbitrary commands on the host running Temporal Server's Worker Service, because the built-in `subprocess` compute provider derives the program name and argument vector from caller-supplied compute provider configuration instead of operator configuration, and the configuration handler invokes it immediately after spec validation with no scaling decision or task arrival required. Deployments are affected when running Temporal Server 1.31.0 through 1.31.2 with the Worker Service active and the per-namespace dynamic config `workercontroller.compute_providers.enabled` either unset (the default, in which case the allowlist check is skipped entirely) or explicitly containing `subprocess`; authentication with a namespace write role is required (CVSS vector PR:L), and a deployment with no authorizer is already fully open rather than being a special case of this flaw. Since the Worker Service process holds persistence credentials for every namespace in the cluster plus the cluster TLS material, successful exploitation reaches beyond the caller's namespace to the cluster as a whole, making this a genuine high-priority issue rather than CVSS inflation. Vendor patches are available in releases 1.31.3 and 1.32.0, and no public exploit was identified at time of analysis.
GPU memory exhaustion in vLLM through 0.29.0 allows remote, unauthenticated attackers to permanently leak GPU KV cache blocks by submitting completion requests containing multiple prompts whose concurrent child requests share a single Mooncake transfer ID. The leak is only reachable in prefill/decode (P/D) disaggregated deployments that have the Mooncake KV-transfer connector enabled - a non-default topology in which the vulnerable ownership bookkeeping runs - and orphaned blocks are never reclaimed until the vLLM process is restarted, progressively starving legitimate inference requests of GPU memory. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, though the attack is network-reachable, low-complexity, and requires no authentication or user interaction (CVSS 4.0 8.7; independent assessment scores the availability-only impact as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Memory exhaustion in vLLM through 0.29.0 lets remote, unauthenticated attackers crash the inference service by supplying an arbitrary 'tp_size' value inside the 'kv_transfer_params' field of requests to the OpenAI-compatible completion endpoints. Because kv_transfer_params is honored only when the server runs in a prefill/decode (P/D) disaggregated deployment using the NIXL KV-transfer connector, the attacker causes unbounded memory allocation in the decode worker that ends in a kernel OOM-kill and full loss of service availability; confidentiality and integrity are unaffected. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but the flaw is trivially reachable over the network (CVSS 4.0 8.7, AV:N/AC:L/PR:N/UI:N/VA:H), and an upstream fix exists as pull request 51137.
Denial of service in vLLM through 0.29.0 lets unauthenticated remote attackers crash the EngineCore and halt all inference by feeding arbitrary remote host and port values through kv_transfer_params when the P2P secondary KV-offload tier is enabled. Each bogus peer address causes the server to allocate a ZeroMQ socket for an unreachable peer session; because no limit is enforced on concurrent sessions, the sockets accumulate until the context quota is exhausted and an uncaught ZMQError terminates the engine (CWE-770, unlimited resource allocation). Exploitation is gated on a non-default configuration - OffloadingConnector configured with TieringOffloadingSpec plus a p2p secondary tier - and availability is the only affected property; an upstream fix exists in pull request 51504, but no public exploit code has been identified at time of analysis.
Denial of service in vLLM through 0.29.0 allows an unauthenticated remote attacker to crash the NIXL decode worker by submitting a single OpenAI-compatible completion request containing multiple prompts of differing lengths together with kv_transfer_params. The crash occurs in NixlBaseConnectorWorker._apply_prefix_caching, where block-count mismatches between the decode and prefill sides hit a reachable assertion (CWE-617); the decode worker terminates and stays unavailable until manually restarted, so a low-effort request loop can repeatedly take serving capacity offline. Impact is confined to availability (CVSS 4.0 8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H), with no confidentiality or integrity effect, and exploitation is gated on a non-default prefill/decode DISAGGREGATED topology that uses the NIXL KV-transfer connector - standard single-node vLLM serving is not affected. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, though the trigger is a trivially crafted multi-prompt API call.
Denial of service in vLLM through 0.29.0 allows an unauthenticated remote attacker to crash the decode engine by sending a single inference request whose kv_transfer_params dictionary is incomplete, for example containing only {"do_remote_prefill": true} without the required remote_block_ids, remote_engine_id, remote_request_id, remote_host, and remote_port fields. The malformed metadata raises an uncaught KeyError inside EngineCore scheduling (CWE-248) during add_new_req_to_recv, terminating the decode engine and causing every subsequently routed request to fail until an operator manually restarts it, yielding a vendor CVSS 4.0 score of 8.7 (VA:H, C/I both N). Exposure is limited to deployments running prefill/decode disaggregated mode with the NIXL connector, which is a non-default serving configuration; standard single-node vLLM never processes kv_transfer_params on this path. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the upstream fix and regression tests are public in PR #54807.
Denial of service via memory exhaustion affects Zapros, the Python HTTP client, in all releases prior to 0.14.0. An unauthenticated remote attacker who controls, or can man-in-the-middle, the origin server can return a small compressed response that the built-in decompression decoder inflates far beyond the caller-supplied bound, because iter_bytes(chunk_size=...) and its default are ignored during decoding - a single chunk can therefore exhaust process or host memory (CVSS 4.0 8.7 High, availability-only: VA:H, VC:N, VI:N, PR:N, UI:N). The vendor released a fix in 0.14.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in MISP before version 2.5.47 lets an authenticated holder of a read-only API key silently regain the complete permission set of the underlying user account. After authenticating with a view-only key, a single request to the updateLoginTime function causes MISP to re-login the session using the full account record, effectively discarding the API key's read-only restriction so the caller can perform write, delete, or administrative actions the key was meant to block. The flaw requires a valid read-only API key tied to an account that itself holds higher privileges, and escalation is bounded by those existing account permissions; no public exploit code has been identified at the time of analysis, and there is no KEV-listed active exploitation.
Privilege escalation in UVdesk core-framework before 1.1.7 lets an authenticated agent who already holds the agent-management privilege promote their own account to ROLE_ADMIN through the editAgent endpoint, gaining full administrative control over agents, tickets and mail configuration. The attacker simply submits their own account identifier together with a role parameter set to ROLE_ADMIN, so the flaw converts a delegated helpdesk-management role into complete tenant takeover. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is only practical in deployments that grant agent-management rights to non-administrators.
Arbitrary code execution in MISP (Malware Information Sharing Platform) before version 2.5.47 arises because the blocklist workflow module writes a user-supplied filename into the MISP export directory after applying only basename() path stripping and empty/dot checks, leaving the file extension unvalidated. An attacker holding the MISP site-administrator role - the only role permitted to invoke this workflow module (PR:H per the assessed vector) - can therefore place a file with an executable extension in that directory, and if the underlying web server is configured to interpret scripts there, the file executes with the web server user's privileges, compromising confidentiality, integrity and availability. This is a genuine CWE-434 unrestricted file upload, but exploitation is gated both by the high privilege requirement and by the non-default web server configuration that executes scripts from the export path; no public exploit identified at time of analysis, and the flaw is addressed by the vendor's extension allowlist fix in 2.5.47.
A write-what-where flaw in the BS_LED64.sys kernel driver shipped with BioStar VIVID LED DJ 4.0.2411.1500 lets an authenticated local user on a Windows host escalate to SYSTEM-level privileges by sending a crafted IOCTL that causes the driver to write attacker-controlled data to an attacker-chosen kernel address. The defect sits in the driver's IOCTL handler (sub_1105C), where the AssociatedIrp value is used without adequate validation, and the CVSS 4.0 base score of 8.5 (assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects total loss of confidentiality, integrity, and availability of the host. Publicly available exploit code exists and was released after the vendor was contacted and failed to respond; it is not confirmed actively exploited (not in CISA KEV). The realistic attack surface is limited: the attacker must already hold standard-user code execution and the RGB control utility and its signed driver must be present, though the signed BS_LED64.sys also functions as a bring-your-own-vulnerable-driver (BYOVD) candidate on machines where the product is not installed.
Local privilege escalation in ColorFul iGameCenter 1.0.3.4 allows a low-privileged Windows user to reach kernel context by exploiting an untrusted pointer dereference in the bundled ENE driver ene.sys (IOCTL handler sub_140001AF0), which processes an attacker-supplied pointer without validation. The vulnerability is strictly local and requires the software plus its driver to already be installed and a local session to exist (CVSS 4.0 AV:L, PR:L, UI:N; assessed scope-changed impact of C:H/I:H/A:H), so remote mass exploitation is not possible; publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV). ColorFul was contacted early and did not respond, so no vendor-released patch is identified at time of analysis, leaving driver removal or blocklisting as the practical mitigations.
Local privilege escalation in BioStar VALKYRIE AURORA 2.10.2411.0800 allows an authenticated low-privileged local attacker to abuse the BS_RVSIO64.sys IOCTL handler and manipulate a PhysicalAddress value, triggering a write-what-where condition in the kernel driver. Successful exploitation can corrupt kernel memory and elevate privileges to SYSTEM or administrator level on an affected host. Publicly available exploit code exists, and exploitation requires prior local code execution plus the vulnerable driver to be installed and loaded, making this a post-access escalation rather than a remote foothold.
Local privilege escalation in Dell Command | Monitor (DCM) versions prior to 10.13.2 allows an authenticated low-privileged Windows user to gain elevated privileges by abusing an incorrectly secured resource that the DCM agent accesses at higher integrity. Successful exploitation requires an existing local foothold on the endpoint, but needs no user interaction and changes scope (S:C) because the attacker leverages DCM's elevated context to impact the wider host - confidentiality and integrity are both rated High, availability is not. There is no remote or unauthenticated attack path, and no public exploit identified at time of analysis; Dell has published a fix in the DSA-2026-380 advisory, making this a credible but not urgent patching priority for fleets running older DCM agents.
Cross-tenant information disclosure in Hatchet before 0.106.1 allows an authenticated tenant worker in a multi-tenant deployment to read durable event-log records belonging to another tenant if it knows that tenant's durable-task UUIDv4. The flaw is in the WorkerStatus gRPC polling path, where ListSatisfiedEntries was called without a tenant filter; single-tenant installs are unaffected, and the UUIDv4 requirement makes practical exploitation unlikely. Vendor-released patch: 0.106.1. No public exploit identified at time of analysis.
Server-side request forgery and arbitrary local file read in MISP before 2.5.47 allow an authenticated user holding permission to add or modify data to upload content through the MISP export/import file handler that the server treats as a file locator rather than an XML document, causing MISP to read local files off the server or issue outbound requests to internal-only services. Assessed CVSS 3.1 is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (8.3 in the CNA's CVSS 4.0 vector), reflecting high confidentiality impact, scope change and no integrity or availability impact, with the blast radius on the SSRF branch bounded by what the MISP host can reach on the internal network. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; exploitation requires a valid MISP account with modify/add privileges (PR:L) and no victim interaction.
Cross-event EventReport disclosure and tampering in MISP versions before 2.5.47 lets an authenticated user who can submit module (enrichment) results reparent, read, or overwrite another event's report by supplying a forged 'id' field in the resolved module data. The root cause is an authorization bypass through a user-controlled key (CWE-639): the report loop in Event::processModuleResultsData did not unset the client-supplied 'id' before calling save(), so the CakePHP ORM updated an existing report row belonging to a different event instead of inserting a new one. Exploitation is gated by authentication and the module-result-submission privilege, and by knowledge of a valid target EventReport id; the independent assessment rates this a genuine but moderate authorization flaw rather than a mass-data-exposure issue, and no public exploit code was identified at time of analysis, though the vendor has published an upstream fix commit (4c1a03b20).
nginx-ignition versions 2.33.0 through 2.35.0 do not enforce single-use semantics on TOTP one-time codes, so a code that has already been used to authenticate can be replayed again within its normal 30-second validity window. Only accounts with OTP 2FA enabled are affected, and exploitation requires the attacker to already hold the victim's password plus a live-interception position (for example an adversary-in-the-middle phishing proxy) to capture the code as the victim types it, which is why the independent assessment treats this as a genuine but low-priority authentication weakness rather than an emergency. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); nginx-ignition 2.35.1 patches the issue.
KubeEdge keadm releases from 1.16.0 before 1.21.2, 1.22.2, and 1.23.1 contain a path traversal in DecompressTarGz that, on Windows edge nodes, can extract archive entries with parent-directory sequences, backslashes, absolute paths, or drive prefixes outside the intended destination. Exploitation requires the operator to run keadm join or installation using an archive obtained from a compromised, replaced, or untrusted download source, making this primarily a supply-chain trust-boundary bug rather than an attack against official artifacts. No public exploit was identified at time of analysis, and vendor fixes are released in 1.21.2, 1.22.2, and 1.23.1.
Any authenticated but non-administrator user on ntopng deployments prior to 6.7.260717 can tamper with threat-intelligence blocklists through the REST endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua, which performed no administrator check before invoking lists_utils.editList. By manipulating the list_name, list_enabled, url, and list_update parameters, a low-privileged account can repoint blocklist downloads to attacker-controlled content, disable existing blocklists, or suppress scheduled updates, with the changes persisted in Redis and reloaded without a lower-level authorization guard. This yields high integrity and availability impact (CVSS 3.1 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) but no confidentiality loss; no public exploit identified at time of analysis, and the issue is remediated by the vendor-fixed version 6.7.260717.
Permanent destruction of an entire group's inventory in HomeBox is possible for any authenticated user who belongs to that group, due to a broken authorization check in the wipe-inventory action handler affecting versions prior to 0.26.0. The flaw lets a self-registered user - who is automatically flagged as a global owner of their own group - select a different group via the X-Tenant header and invoke POST /v1/actions/wipe-inventory against it, deleting data that cannot be recovered without external backups. Exploitation requires an authenticated account on a multi-group instance where the attacker is also a legitimate member of the victim group, so single-user or single-group deployments are not affected; no public exploit identified at time of analysis.