Privilege escalation in MISP before version 2.5.47 lets an authenticated holder of a read-only API key silently regain the complete permission set of the underlying user account. After authenticating with a view-only key, a single request to the updateLoginTime function causes MISP to re-login the session using the full account record, effectively discarding the API key's read-only restriction so the caller can perform write, delete, or administrative actions the key was meant to block. The flaw requires a valid read-only API key tied to an account that itself holds higher privileges, and escalation is bounded by those existing account permissions; no public exploit code has been identified at the time of analysis, and there is no KEV-listed active exploitation.
Privilege escalation in UVdesk core-framework before 1.1.7 lets an authenticated agent who already holds the agent-management privilege promote their own account to ROLE_ADMIN through the editAgent endpoint, gaining full administrative control over agents, tickets and mail configuration. The attacker simply submits their own account identifier together with a role parameter set to ROLE_ADMIN, so the flaw converts a delegated helpdesk-management role into complete tenant takeover. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is only practical in deployments that grant agent-management rights to non-administrators.
Arbitrary code execution in MISP (Malware Information Sharing Platform) before version 2.5.47 arises because the blocklist workflow module writes a user-supplied filename into the MISP export directory after applying only basename() path stripping and empty/dot checks, leaving the file extension unvalidated. An attacker holding the MISP site-administrator role - the only role permitted to invoke this workflow module (PR:H per the assessed vector) - can therefore place a file with an executable extension in that directory, and if the underlying web server is configured to interpret scripts there, the file executes with the web server user's privileges, compromising confidentiality, integrity and availability. This is a genuine CWE-434 unrestricted file upload, but exploitation is gated both by the high privilege requirement and by the non-default web server configuration that executes scripts from the export path; no public exploit identified at time of analysis, and the flaw is addressed by the vendor's extension allowlist fix in 2.5.47.
A write-what-where flaw in the BS_LED64.sys kernel driver shipped with BioStar VIVID LED DJ 4.0.2411.1500 lets an authenticated local user on a Windows host escalate to SYSTEM-level privileges by sending a crafted IOCTL that causes the driver to write attacker-controlled data to an attacker-chosen kernel address. The defect sits in the driver's IOCTL handler (sub_1105C), where the AssociatedIrp value is used without adequate validation, and the CVSS 4.0 base score of 8.5 (assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects total loss of confidentiality, integrity, and availability of the host. Publicly available exploit code exists and was released after the vendor was contacted and failed to respond; it is not confirmed actively exploited (not in CISA KEV). The realistic attack surface is limited: the attacker must already hold standard-user code execution and the RGB control utility and its signed driver must be present, though the signed BS_LED64.sys also functions as a bring-your-own-vulnerable-driver (BYOVD) candidate on machines where the product is not installed.
Local privilege escalation in ColorFul iGameCenter 1.0.3.4 allows a low-privileged Windows user to reach kernel context by exploiting an untrusted pointer dereference in the bundled ENE driver ene.sys (IOCTL handler sub_140001AF0), which processes an attacker-supplied pointer without validation. The vulnerability is strictly local and requires the software plus its driver to already be installed and a local session to exist (CVSS 4.0 AV:L, PR:L, UI:N; assessed scope-changed impact of C:H/I:H/A:H), so remote mass exploitation is not possible; publicly available exploit code exists, but there is no confirmation of active exploitation (not in CISA KEV). ColorFul was contacted early and did not respond, so no vendor-released patch is identified at time of analysis, leaving driver removal or blocklisting as the practical mitigations.
Local privilege escalation in BioStar VALKYRIE AURORA 2.10.2411.0800 allows an authenticated low-privileged local attacker to abuse the BS_RVSIO64.sys IOCTL handler and manipulate a PhysicalAddress value, triggering a write-what-where condition in the kernel driver. Successful exploitation can corrupt kernel memory and elevate privileges to SYSTEM or administrator level on an affected host. Publicly available exploit code exists, and exploitation requires prior local code execution plus the vulnerable driver to be installed and loaded, making this a post-access escalation rather than a remote foothold.
Local privilege escalation in Dell Command | Monitor (DCM) versions prior to 10.13.2 allows an authenticated low-privileged Windows user to gain elevated privileges by abusing an incorrectly secured resource that the DCM agent accesses at higher integrity. Successful exploitation requires an existing local foothold on the endpoint, but needs no user interaction and changes scope (S:C) because the attacker leverages DCM's elevated context to impact the wider host - confidentiality and integrity are both rated High, availability is not. There is no remote or unauthenticated attack path, and no public exploit identified at time of analysis; Dell has published a fix in the DSA-2026-380 advisory, making this a credible but not urgent patching priority for fleets running older DCM agents.
Server-side request forgery and arbitrary local file read in MISP before 2.5.47 allow an authenticated user holding permission to add or modify data to upload content through the MISP export/import file handler that the server treats as a file locator rather than an XML document, causing MISP to read local files off the server or issue outbound requests to internal-only services. Assessed CVSS 3.1 is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (8.3 in the CNA's CVSS 4.0 vector), reflecting high confidentiality impact, scope change and no integrity or availability impact, with the blast radius on the SSRF branch bounded by what the MISP host can reach on the internal network. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; exploitation requires a valid MISP account with modify/add privileges (PR:L) and no victim interaction.
Cross-event EventReport disclosure and tampering in MISP versions before 2.5.47 lets an authenticated user who can submit module (enrichment) results reparent, read, or overwrite another event's report by supplying a forged 'id' field in the resolved module data. The root cause is an authorization bypass through a user-controlled key (CWE-639): the report loop in Event::processModuleResultsData did not unset the client-supplied 'id' before calling save(), so the CakePHP ORM updated an existing report row belonging to a different event instead of inserting a new one. Exploitation is gated by authentication and the module-result-submission privilege, and by knowledge of a valid target EventReport id; the independent assessment rates this a genuine but moderate authorization flaw rather than a mass-data-exposure issue, and no public exploit code was identified at time of analysis, though the vendor has published an upstream fix commit (4c1a03b20).
KubeEdge keadm releases from 1.16.0 before 1.21.2, 1.22.2, and 1.23.1 contain a path traversal in DecompressTarGz that, on Windows edge nodes, can extract archive entries with parent-directory sequences, backslashes, absolute paths, or drive prefixes outside the intended destination. Exploitation requires the operator to run keadm join or installation using an archive obtained from a compromised, replaced, or untrusted download source, making this primarily a supply-chain trust-boundary bug rather than an attack against official artifacts. No public exploit was identified at time of analysis, and vendor fixes are released in 1.21.2, 1.22.2, and 1.23.1.
Any authenticated but non-administrator user on ntopng deployments prior to 6.7.260717 can tamper with threat-intelligence blocklists through the REST endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua, which performed no administrator check before invoking lists_utils.editList. By manipulating the list_name, list_enabled, url, and list_update parameters, a low-privileged account can repoint blocklist downloads to attacker-controlled content, disable existing blocklists, or suppress scheduled updates, with the changes persisted in Redis and reloaded without a lower-level authorization guard. This yields high integrity and availability impact (CVSS 3.1 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) but no confidentiality loss; no public exploit identified at time of analysis, and the issue is remediated by the vendor-fixed version 6.7.260717.
Permanent destruction of an entire group's inventory in HomeBox is possible for any authenticated user who belongs to that group, due to a broken authorization check in the wipe-inventory action handler affecting versions prior to 0.26.0. The flaw lets a self-registered user - who is automatically flagged as a global owner of their own group - select a different group via the X-Tenant header and invoke POST /v1/actions/wipe-inventory against it, deleting data that cannot be recovered without external backups. Exploitation requires an authenticated account on a multi-group instance where the attacker is also a legitimate member of the victim group, so single-user or single-group deployments are not affected; no public exploit identified at time of analysis.
Cross-tenant record tampering in HomeBox versions prior to 0.26.0 allows an authenticated low-privileged user to overwrite or permanently delete another group's maintenance entries by supplying a maintenance-entry UUID that belongs to a different tenant. The flaw is a CWE-639 broken object-level authorization (IDOR) in the maintenance-entry update and delete repository paths, which act on the caller-supplied ID without confirming the record belongs to the caller's active group; exploitation requires a valid session plus knowledge of a non-enumerable random UUID, so it is access-gated rather than trivially reachable and is practically limited to multi-group/multi-tenant deployments. Impact is blind write/delete only with no data disclosure, and there is no public exploit identified at time of analysis and no indication of active exploitation. Vendor-released patch: 0.26.0.
HomeBox versions prior to 0.26.0 allow an authenticated low-privilege user to read and overwrite another tenant's notification configuration via PUT /v1/notifiers/{id}, exposing plaintext Shoutrrr credentials (Slack, SMTP, Telegram, Pushover, Discord) that are stored inside the notifier URL. The primary assessed impact is credential disclosure (high confidentiality), with a more limited integrity impact from the ability to point the victim's notifications at an attacker-controlled webhook. Exploitation requires a multi-tenant HomeBox deployment, a valid account, and knowledge of the victim's notifier UUID - UUIDs are not enumerable, which is the main real-world limiting factor; no public exploit has been identified at time of analysis, and the vendor fixed the issue in 0.26.0.
An authorization flaw in the pki-core v2 REST ACL filter lets an authenticated member of the default Certificate Manager Agents group invoke profile-management operations reserved for Administrator-level accounts, so a request to POST /v2/profiles/raw that should require profiles.create is instead authorized under the lower-privileged profiles.approve permission. The root cause is that when a literal ACL key (profiles.create) and a wildcard ACL key (profiles.approve) both match, the filter picks the winner by lexicographic string comparison rather than by specificity, allowing the wildcard mapping to override the more specific literal one; CVSS 3.1 rates this 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with the highest threat to the confidentiality and integrity of the CA's issuance policy. Exploitation requires valid agent-level credentials and the default ACL configuration, and no public exploit code has been identified at time of analysis, so this is a privilege escalation inside an existing trusted role rather than unauthenticated access.
A path traversal (CWE-22) vulnerability in CRI-O's container checkpoint/restore feature allows a highly privileged, remote attacker to perform unintended operations on the host filesystem by supplying a malicious checkpoint archive during container restoration. Exploitation requires the non-default checkpoint/restore functionality to be enabled and the attacker to have high privileges (PR:H) to trigger restoration of untrusted content, resulting in a scope change from container to host with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit identified at time of analysis. Affected products include Red Hat OpenShift Container Platform 4 as per CPE data.
SQL injection in Chartbrew versions prior to 5.2.3 allows an unauthenticated remote attacker to break out of an intended string literal and execute arbitrary ClickHouse SQL whenever a ClickHouse-backed chart uses variable binding and the attacker controls the variable value; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no privileges or user interaction are required, and the subsequent scope increase (SC:H/SI:H/SA:H) reflects impact landing on the ClickHouse data source rather than Chartbrew itself. The vulnerable path is fully exposed through public dashboards, while non-public dashboards require an authenticated session. Exploitation can disclose data stored in the ClickHouse instance and, where the ClickHouse configuration permits file or URL table functions, reach local files or internal network resources; vendor-released patch: 5.2.3, and no public exploit code has been identified at time of analysis. This is a genuine, high-priority CWE-89 issue with a credible unauthenticated path, though its reachability depends on the deployment using the ClickHouse plugin with variable bindings.
Command injection in CrossWire Xiphos 4.3.2 and earlier lets a local attacker execute arbitrary shell commands with the privileges of the user running the application by placing shell metacharacters in data that Xiphos later interpolates into unsanitized popen() shell pipelines. Two code paths are involved: the personal-commentary rename action (on_rename_perscomm_activate in src/gtk/menu_popup.c), where the module section name is spliced into a cd/sed command, and the separate-image viewer (show_separate_image in src/main/url.cc), where an image filename is spliced into an external viewer's command line. Exploitation requires the victim to trigger one of those actions on attacker-supplied data (a crafted module or image file), the impact is confined to the victim's own account because no privilege escalation is demonstrated, and publicly available exploit code exists (SSVC records exploitation as 'poc'), although the issue is not in CISA KEV and EPSS is low at 0.15% (5th percentile).
Local privilege escalation in BleachBit on Windows lets an unprivileged local user turn an elevated cleaning operation into arbitrary privileged file deletion and, via Windows Installer rollback behavior, full SYSTEM privileges. The flaw affects BleachBit versions prior to 6.0.1 and is exploitable by an authenticated, unprivileged interactive user who wins a TOCTOU race while BleachBit runs with elevated rights in privileged Windows cleaning mode; the vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). No public exploit code was identified and there is no CISA KEV listing at time of analysis, so the practical risk is a genuine local privilege-escalation issue worth prioritizing on Windows hosts that run BleachBit with elevation.
Local privilege escalation in Dell Inventory Collector Client versions prior to 15.0.0 allows a low-privileged Windows user to place a malicious executable along an unquoted service search path, resulting in code execution in the context of the affected service and elevation of privileges. The attack is not network-reachable and requires an existing local foothold plus write access to a directory that precedes the legitimate binary on the unquoted path, with the vulnerable component restarted or re-launched so the path is re-resolved. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor rates the issue 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); vendor-released patch: 15.0.0.
Local privilege escalation in Zephyr RTOS allows an unprivileged user-mode thread that holds access to the Intel time-aware GPIO (TGPIO) device object to perform two uncontrolled 8-byte supervisor-mode writes to attacker-chosen kernel addresses via the tgpio_pin_read_ts_ec() syscall. The syscall's verification handler omitted the K_SYSCALL_MEMORY_WRITE() check that the sibling handlers in the same file already perform, converting a benign timestamp read-back into a write-what-where primitive that can corrupt kernel data structures, escalate the calling thread to supervisor privilege, or crash the system. Exposed builds are narrow: CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y must both be set, and because the affected source file failed to compile from v3.6.0 until after it was repaired past v4.4.0, the realistically exposed population is v3.5.0 builds plus downstream trees that locally patched that build breakage; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though it is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 write sensitive information - specifically credentials passed to its cmdlets - into the Windows PowerShell event log, where they can be harvested by a low-privileged local user who can read that log. Exploitation requires an authenticated local presence on the Windows host (CVSS vector AV:L/PR:L) and depends on privileged automation having actually run through DCPP so that secrets were logged first; no user interaction is required. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV, but the vendor assigns it a 7.8 severity while our independent assessment treats the impact as confidentiality-only (C:H/I:N/A:N), materially lowering real-world risk given the local-only vector, the dependency on prior DCPP use, and the niche deployment footprint.
Missing authorization checks on Warpgate's recording-stream WebSocket let any authenticated user with an ordinary account watch live terminal input and output from other people's proxied sessions. Specifically, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs guards /@warpgate/admin/api/recordings/{uuid}/stream with session authentication only and never calls require_admin_permission for AdminPermission::RecordingsView, so an attacker who can identify an active recording's UUID receives, in real time, the keystrokes and output of proxied SSH, MySQL, and PostgreSQL sessions - including credentials and commands belonging to regular users and administrators. Warpgate versions prior to 0.25.6 are affected and the flaw is fixed in 0.25.6 (CVSS 3.1 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attack is authenticated and timing-dependent because the recording must be actively streaming, and no public exploit code was identified at time of analysis.
Stored cross-site scripting in Joplin's Fountain screenplay rendering path lets a malicious Fountain code block execute script in the note viewer whenever Fountain rendering is active. Affected are Joplin desktop and mobile clients prior to 3.6.15 and 3.7.2, plus Joplin Server deployments where published notes are rendered with Fountain enabled by default; the injected script can read content later loaded into the reused note viewer, and when published notes share the server's origin it can reach data available to an authenticated browser session in that origin. Exploitation requires the attacker to plant the malicious Fountain block in a note the victim renders (consistent with the PR:L vector), and no public exploit code was identified at time of analysis - the risk is real but gated on Fountain rendering being enabled. Fixed versions 3.6.15 and 3.7.2 are available.
Server-side request forgery in self-hosted draw.io (jgraph/drawio) prior to 30.3.8 lets an unauthenticated remote attacker point the /embed2.js?fetch= endpoint at internal IPv6 Unique Local Address (ULA) resources and read the reflected response, including AWS instance metadata served on the fd00:ec2::/32 range, which can expose IAM credentials and other sensitive internal data. The flaw is a filter bypass rather than a missing check: the private-address guard compared the JDK's fully expanded IPv6 text form against the compressed prefixes 'fc00::' and 'fd00::', so the entire fc00::/7 ULA space slipped through. Exploitation requires a reachable self-hosted draw.io instance and an internal target genuinely addressable over IPv6 ULA - IPv4 private ranges remain blocked, and neither authentication nor the ENABLE_DRAWIO_PROXY=1 flag nor DNS rebinding is needed on the primary /embed2.js path. No public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing); the CVSS 4.0 base score is 7.7 (High), reflecting a network-vector, scope-changing confidentiality impact.
Unauthenticated remote attackers can exhaust memory and trigger an out-of-memory kill of Envoy Proxy by sending HTTP/2 requests that include a large Host header alongside an existing :authority pseudo-header, since the discarded Host value is copied but never charged against header size or count limits, and HPACK dynamic-table indexing lets an attacker repeatedly reference that large value across a bounded number of streams. All Envoy releases before 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are affected, including both the nghttp2 and oghttp2 HTTP/2 codec implementations, and the flaw is reachable on any listener that terminates HTTP/2 with no authentication or user interaction required (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-401). No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the low complexity and lack of prerequisites make this a practical availability risk for internet-facing edge proxies; note the supplied "Authentication Bypass" tag is misleading - the impact is availability-only, with no confidentiality or integrity loss.
Envoy Proxy releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 can be crashed by a remote, unauthenticated attacker through its HTTP/3 datagram and Capsule Protocol handling (prerequisites: PR:N, no user interaction). When a request enters a stream-recreation path such as an internal redirect, the HttpDatagramHandler keeps a cached pointer to the original RequestDecoder; a subsequent HTTP/3 datagram invokes decodeData through that freed decoder, producing invalid virtual dispatch and process termination (CWE-416 use-after-free, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation is gated on a non-default configuration - HTTP/3 (QUIC) downstream plus Capsule Protocol enabled, e.g. MASQUE connect-udp tunneling - combined with an internal-redirect route and precise frame sequencing; no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote clients can crash Envoy Proxy by sending a path-less CONNECT request when the ext_authz HTTP filter is configured to apply query_parameters_to_set or query_parameters_to_remove mutations and the external authorization service returns such a mutation. The crash is a null-pointer dereference in the ext_authz filter's Filter::onComplete path, producing a denial of service (CVSS 7.5, A:H) against the affected proxy process; impact is limited to availability, with no confidentiality or integrity loss. Exploitation is gated by two non-default configuration prerequisites - accepting path-less CONNECT and enabling ext_authz query-parameter mutation - and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Joplin Server before 3.7.7 allows an authenticated, low-privileged user to publish an empty-title resource whose attacker-controlled MIME type (image/svg+xml) is served inline, so a crafted SVG executes in a victim's browser when the public share link is opened. The flaw lives in the GET /shares/:id?resource_id= route, which reflects the user-supplied MIME and omits Content-Disposition when the resource title is empty; under the default configuration user content shares the Joplin Server application origin, so the script can read same-origin administrative data and anti-CSRF tokens and, against an authenticated victim, act with that victim's session. Installations that set a separate USER_CONTENT_BASE_URL still execute the script, but confined to the user-content origin; the issue is fixed in 3.7.7 and no public exploit code was identified at time of analysis.
Denial of service in Envoy Proxy releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, where the optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame that lacks the END_STREAM flag, causing Envoy to complete and deferred-delete the ActiveRequest while oghttp2 keeps the stream open. The resulting dangling reference in ClientStreamImpl (response_decoder_) can be dereferenced by a subsequent frame on that stream, freeing-then-using memory and crashing the Envoy process (CWE-20, CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - assessed independently at AC:H). Exploitation is remote and unauthenticated once preconditions hold, but it is limited to non-default configurations: the oghttp2 upstream codec must be explicitly enabled, the malformed trailers must be emitted by the upstream server Envoy proxies to (an attacker-controlled or compromised upstream, or injected frames on that connection), and the default nghttp2 codec rejects the malformed trailers outright. Vendor patches are available (1.36.10, 1.37.6, 1.38.4, 1.39.1); no public exploit code was identified and the issue is not in CISA KEV at time of analysis.
An access-control bypass in Envoy Proxy (all versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1) allows unauthenticated remote clients to reach routes that HTTP RBAC policies were configured to deny, resulting in disclosure of protected content. The flaw only materializes when a NEGATIVE (DENY) policy uses a safe_regex matcher against header values and a byte-oriented route matcher independently reads the raw header bytes; positive ALLOW regexes fail closed and exact, prefix, suffix, and contains matchers are unaffected. No public exploit code has been identified at time of analysis, and the vendor has released fixed versions, so real-world risk is driven almost entirely by whether a deployment uses that specific safe_regex-in-negative-policy configuration.
Request smuggling in Envoy Proxy allows an unauthenticated HTTP/2 client to embed a complete HTTP/1.1 request inside the data payload of an extended CONNECT (a generic, non-WebSocket HTTP upgrade) so that Envoy forwards that payload upstream before the upstream has accepted the upgrade, writes it unframed to a keep-alive HTTP/1.1 upstream, and returns the upstream socket to the shared pool with a smuggled response still queued - meaning a different, unrelated downstream client can subsequently be served the attacker's response. Every Envoy release prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 is affected, but exploitation is configuration-dependent: the listener must proxy a generic non-WebSocket upgrade to an HTTP/1.1 upstream with backend keep-alive enabled, shared (non-per-downstream) connection pools, and max_requests_per_connection not set to 1; WebSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection=1 are explicitly out of scope for the demonstrated path. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Authenticated x-ui panel users (including low-privilege ones) can broaden the network exposure of the panel's xray management gRPC listener in version 0.3.2 by editing the xray configuration template in the settings interface and then triggering a panel restart, which regenerates that listener bound to a non-loopback address instead of its intended loopback-only binding. The flaw is an improper access control issue (CWE-284) that lets any panel account change a network-exposure boundary it should not control; practical impact depends on a second party being able to reach the newly exposed gRPC endpoint, and exploitation requires valid panel credentials plus the ability to restart the panel (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L per independent assessment). There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is very low at 0.15% (5th percentile), so the risk signals are mixed and lean toward moderate-but-not-urgent priority.
Path-based RBAC authorization bypass in Envoy Proxy lets an unauthenticated remote client reach protected backends such as /admin by appending a semicolon path parameter (e.g. /admin;x), because the router strips that suffix before route matching while the RBAC url_path matcher evaluates the untouched raw path. Exploitation is tightly gated rather than default: it requires a route configured with ignore_path_parameters_in_path_matching, a path-based RBAC rule (PathMatcher or UriTemplateMatcher) guarding the protected path, and a crafted request that still selects the protected route after stripping. All releases prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 are affected; the vendor has published fixed releases, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Memory exhaustion in Apache MINA's CompressionFilter lets unauthenticated remote attackers crash the affected JVM by sending ZLib-compressed data that inflates to an unbounded size, since the pre-fix filter allocates an output buffer proportional to the decompressed result without enforcing any limit (CWE-409, CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact). The flaw is reachable only in deployments that instantiate the filter for inbound decompression (compressInbound=true) and expose that endpoint to untrusted network peers; applications that never enable CompressionFilter, or that already configure a maxDecompressedSize bound, are not affected. Our assessment rates this a genuine but bounded availability risk rather than a critical priority, and no public exploit code was identified at time of analysis; there is no KEV listing or confirmed in-the-wild activity.
Denial of service in FalkorDB v4.20.1, the Redis-module graph database, where the GRAPH.EFFECT replication handler in src/effects/effects_apply.c enforced graph-state assumptions with ASSERT() calls instead of proper error handling. Remote attackers who can reach the Redis endpoint and issue GRAPH.EFFECT with an effects buffer referencing a node ID or label schema that does not exist locally trip a reachable assertion and crash the process (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact confined to availability and no data disclosure or integrity effect. No public exploit code or active exploitation has been confirmed at time of analysis, though the attack primitive is simple: a single crafted command against an unauthenticated or credentialed Redis instance. The vendor has published an upstream fix in commit 17cb1f8f0 (PR #2247).
A memory leak in SmallRye Fault Tolerance, the fault-tolerance library used by Quarkus for retries, circuit breakers, and related resilience patterns, allows unauthenticated remote attackers to steadily exhaust application heap and cause denial of service on services that expose endpoints using the @ApplyGuard or @ApplyFaultTolerance annotations. Each request routed through those fault-tolerance guards allocates internal tracking objects that are never released, so sustained traffic grows memory usage until the JVM slows and crashes with an out-of-memory condition. The vendor CVSS 3.1 base of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as high-severity availability-only impact, consistent with the CWE-400 uncontrolled resource consumption classification and the 'Denial Of Service' tag; no public exploit identified at time of analysis, and applications that do not use these annotations are unaffected.
A stack overflow in the _ValidateUnion_Clauses routine of FalkorDB (a Redis graph module) versions 4.20.1 through 4.20.4 lets a crafted graph query containing a malicious UNION clause crash the database process, producing a denial of service. Per the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) the flaw is network-reachable, low-complexity, and requires no privileges or user interaction, with impact confined to availability - no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation nonetheless requires network reachability to the FalkorDB/Redis endpoint, and in hardened deployments with Redis AUTH or ACLs the PR:N assumption may not hold in practice.
A crafted graph query submitted to FalkorDB (Redis module) versions 4.20.1 through 4.20.4 drives an out-of-bounds read in the node_token_count/relation_token_count code path, crashing the module and the Redis process that hosts it - a purely availability-impacting denial of service with no data exposure or code execution. The flaw is network reachable and low complexity; per our independent assessment the practical authentication requirement depends on the deployment, since exploitation is effectively unauthenticated when Redis is exposed without requirepass or ACLs, but requires an attacker to already hold valid query privileges wherever Redis authentication or ACLs are enforced. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and impact is confined to service availability (base 7.5, NVD vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
OpenBao versions prior to 2.6.0 fail to reject syntax-significant characters when templated identity data is substituted into ACL, PKI, and SSH policies, allowing an authenticated principal who can write that identity data to broaden path matching, obtain certificates for unauthorized domains, or add unauthorized SSH principals. Exploitation is gated on a non-default configuration: the policy must use templates that substitute attacker-modifiable identity metadata (for example {{identity.entity.metadata.domains}} or {{identity.entity.metadata.sans}}), and the attacker must already hold the capability to update that identity record (such as update on identity/entity), consistent with the assessed CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. Deployments whose templates rely solely on the randomly generated identity.entity.id value are not affected, there is no user interaction, and no public exploit code was identified at time of analysis.
Stored cross-site scripting in GoCD's Compare Pipeline page affects versions 18.3.0 through 25.x and allows an attacker holding commit access to a tracked material to inject URI or HTML special characters into a commit comment that GoCD later renders as an unescaped tracking-tool link. Successful exploitation within a victim's browser session can expose a privileged user's session or permit changes performed with that victim's credentials and privileges, though the CVSS 4.0 vector (AC:H/AT:P/PR:L/UI:P) and the layered prerequisites make this a non-trivial, non-drive-by issue. The flaw is fixed in GoCD 26.1.0, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in libX11 before 1.8.14 allows a malicious or compromised X server to corrupt memory in connecting X11 clients via a crafted XkbGetMap reply that overflows the key_sym_map. This client-side vulnerability has an inverted threat model: the attacker must control the X server the victim connects to, with exploitation requiring user interaction (UI:R) and high attack complexity (AC:H). CVSS 3.1 score is 7.5 High; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Envoy Proxy's admin statistics page lets an attacker run script in the admin interface's origin: the /stats?format=html endpoint (StatsHtmlRender) sanitizes statistic values but emits statistic names raw, so a data-plane component that folds attacker-supplied request path segments into dynamic stat names - notably grpc_stats with stats_for_all_methods enabled - can persist a script-bearing name that fires when an operator opens the page in a browser. Every release before 1.36.10, 1.37.6, 1.38.4, and 1.39.1 is affected; the independently assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N (7.4), i.e. unauthenticated remote influence over the injected text but multiple gating prerequisites plus required operator interaction, with impact scoped to the admin origin where privileged same-origin requests can then be issued. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; exploitation is realistic only where the admin HTML endpoint is browser-reachable and a dynamic-stat-generating component is enabled.
Authentication bypass in Joplin Server prior to 3.7.2 allows an unauthenticated remote attacker who can control or influence a SAML identity assertion to obtain a valid session for an existing local password-based account purely by matching the asserted email address, granting read and write access to that user's notes, files, and settings without knowledge of the local password. The defect is gated to deployments running mixed authentication - local password accounts and SAML SSO enabled together (SAML_ENABLED=true) - so SAML-only, local-only, and default single-auth installations are not exposed. The issue is fixed in version 3.7.2 via a check that rejects SSO login for non-external accounts; no public exploit identified at time of analysis.
Password reset link poisoning in Gladys Assistant before 5.1.0 lets unauthenticated remote attackers obtain valid password reset tokens for arbitrary accounts by sending a crafted request with an attacker-controlled origin parameter to the forgot_password endpoint. The flaw requires victim interaction-the targeted user must click the poisoned reset link delivered to their mailbox-so it is a targeted, phishing-dependent account-takeover vector rather than a hands-off exploit; successful abuse can compromise administrator accounts. No public exploit code was identified at time of analysis, and the vendor has released Gladys Assistant 5.1.0 as the fix.
Signature verification bypass in Red Hat's openshift/oc-mirror tool allows an attacker who can intercept or manipulate traffic to the release-signature endpoint to have a forged PGP-signed release payload accepted and mirrored into a disconnected OpenShift 4 registry. The defect (CWE-347) causes oc-mirror to evaluate signature errors before the full signed body has been processed, so a message carrying a legitimate Red Hat release key ID but an invalid signature can pass validation during a normal mirror operation. Exploitation is gated by a demanding precondition: the attacker must already hold a man-in-the-middle/on-path position on the network path and the victim must be actively running an oc-mirror signature-verifying operation; no credentials against oc-mirror are required (PR:N) and no user interaction beyond running the mirror process is needed (UI:N). The realistic impact is integrity-only, since the assessed vector scores C:N/I:H/A:N, and no public exploit has been identified at time of analysis.
Cross-workspace read and modification of model parameter defaults in MaxKB 2.10.3-lts and earlier is possible for an authenticated user who holds model-read permission in a workspace they control, simply by supplying a model_id that belongs to a victim workspace. The model parameter form route checks authorization against the workspace in the URL path, but the underlying ModelSerializer.ModelParams fetches the Model by id alone without filtering on workspace_id, so the object-level check is bypassed (CWE-639, CVSS 3.1 base 7.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). Impact is bounded: it is limited to reading or overwriting the victim's model_params_form, which can indirectly alter the default behavior of workflows that consume that model, and practical exploitation requires a multi-tenant deployment plus knowledge or guessing of a valid victim model_id; no public exploit identified at time of analysis and no fixed version is available as of this review.
Unrestricted file upload in CuteNews 2.1.2 allows an authenticated user who can reach the Media Manager panel to upload a file of a dangerous type - typically a PHP script - through core/modules/media.php and then request that file to execute arbitrary code in the web application's context; the researcher's disclosure notes this can be driven to a reverse shell and remote server access. The flaw is rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning total confidentiality, integrity, and availability impact once triggered, but it is gated behind high privileges: the attacker must already hold a Media Manager-capable (administrative/editor-tier) account. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no vendor-released patch has been identified at time of analysis.
Temporal Server releases 1.30.0 and later let an authenticated caller holding write permission in only one namespace trick the server into issuing attacker-chosen, state-changing HTTP POSTs against its own administrative frontend API, enabling cross-namespace workflow termination, namespace registration, configuration tampering, and full namespace deletion. The caller exploits confused-deputy logic (CWE-807) by attaching a Workflow completion callback whose URL passes the configured address allowlist and whose header map contains a non-empty 'source' header, which the History service interprets as evidence the callback is internal; no network access to the internal frontend is required because the server makes the request itself. Releases 1.25.0 through 1.29.7 carry the same defect but require the 'source' header to exactly match a configured cluster-ID UUID that a namespace-scoped caller cannot read through the API, making exploitation materially harder; no public exploit code was identified at time of analysis, and exploitation is gated on non-default deployment settings. Vendor-released patches exist in 1.30.7, 1.31.3, and 1.32.0.
Arbitrary file write through a path traversal flaw affects NotebookLM MCP versions 1.6.0 through 2.0.2, allowing an authenticated caller of the POST /batch-to-vault endpoint - or, since 1.7.0, of the batch_to_vault MCP tool - to steer generated Markdown and JSON files outside the intended vault into any directory writable by the server process. The vendor rates it 7.1 under CVSS 4.0, and the independent assessment confirms integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N): files can be written but not read or deleted through this vector. Containment only activates when NOTEBOOKLM_VAULT_ROOT is set, so default deployments are fully exposed, and there is no public exploit identified at time of analysis and no CISA KEV listing.