Local privilege escalation in the Netdata Windows Agent (versions 2.0.0 through 2.10.3) allows an authenticated low-privileged user to execute arbitrary commands with SYSTEM privileges by placing malicious commands in their PowerShell profile and then triggering an MSI repair, which runs powershell.exe as SYSTEM without the -NoProfile flag. The vulnerability (CWE-269) is fixed in Netdata Agent 2.10.4; no public exploit code has been identified at time of analysis.
Local privilege escalation in Qualcomm Snapdragon firmware allows an attacker with low privileges to gain high-impact code execution and control over the device. The flaw resides in an exposed dangerous function within a gRPC server (CWE-749) and affects specific QPM (v3.0.127.2, v3.0.126.7, v3.0.125.4) and QSC (v1.21.0, v1.19.1, v1.17.1) builds. Exploitation requires local access and a pre-existing low-privileged foothold; no public exploit or active exploitation has been identified, and EPSS is only 0.15%.
Crypt::SelfCertificate versions 1.01 through 1.05 for Perl ship embedded malware: the module's generate_certificate routine launches a Python dropper disguised as a certificate sample file, which decodes a base64-obfuscated URL, fetches the response body over HTTP, and executes it in memory under the privileges of the invoking user. Any host that installs one of these CPAN releases and then calls the function is exposed to arbitrary code execution with high confidentiality, integrity, and availability impact (assessed CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation is unauthenticated per the vector but requires the victim to install the package and trigger the function, and there is no public exploit identified at time of analysis. Because the payload is fetched and run without writing a script to disk, it behaves as a fileless stage and leaves minimal on-host artifact beyond the installed module itself - a genuine, high-priority supply-chain compromise rather than an inflated score.
Authenticated code execution in Sentry's relocation import worker lets a user with a valid account on an affected instance run arbitrary code in the worker process by uploading a crafted relocation archive. Only instances that have explicitly enabled the relocation (backup import/export) feature are exposed, since that feature is disabled by default in self-hosted installations; affected versions run from 23.11.0 up to but not including 26.7.0, which contains the fix. Severity is high (7.7 under CVSS 4.0), requires authenticated access and a non-default feature flag, and no public exploit has been identified at time of analysis.
Server-side request forgery in the WebSSH/WebTelnet listener of Lantronix SLC8000 (before firmware 9.7.0.3), EMG8500/EMG7500 (before firmware 9.7.0.1), and all firmware versions of SLB882 allows unauthenticated remote attackers to make the device open outbound Telnet connections to attacker-chosen hosts by tampering with the rooturl parameter, turning the out-of-band management appliance into a pivot for enumerating or reaching internal network endpoints that are otherwise unreachable from the attacker's position. The flaw sits in the custom shellinaboxd component, which trusts the client-supplied rooturl value to determine its own IP address, and it is remotely exploitable without authentication or user interaction (CVSS:4.0 7.7; independent assessment CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). Impact is bounded to reconnaissance and lateral communication rather than code execution or data corruption; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk depends on whether the management interface is exposed to an attacker-controlled network segment. This is a genuine but bounded risk.
Unauthenticated server-side request forgery in the Lantronix SLC8000, EMG8500/EMG7500 and SLB882 console servers lets any remote party that can reach the WebSSH/WebTelnet listener coerce the device into opening an SSH session to an arbitrary, attacker-chosen host or IP. The flaw lives in the custom shellinaboxd daemon, which derives its own address from the client-supplied rooturl parameter, so tampering with that parameter redirects the terminal connection elsewhere, allowing attackers to enumerate or talk to internal endpoints that are otherwise unreachable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, though a detailed technical writeup and a VulnCheck advisory describe the mechanism; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, reflecting low confidentiality impact on the device itself and high confidentiality impact on systems behind it.
Unauthenticated server-side request forgery in the WebSSH/WebTelnet web terminal listener of Lantronix SLC8000 console servers (before firmware v9.7.0.3), EMG8500/EMG7500 out-of-band gateways (before firmware v9.7.0.1), and all firmware versions of the SLB882 lets remote attackers make the device open SSH connections of their choosing, including to hosts on internal networks the device can route to but the attacker cannot. The trigger is an overlong username that overflows a fixed-size buffer in a custom shellinaboxd snprintf call, truncating the device-derived IP suffix of the connection target and redirecting it to an attacker-specified endpoint. The independent assessment rates this High (CVSS 4.0 base 7.7, AV:N/AC:L/AT:N/PR:N/UI:N, VC:L/SC:H), remote, unauthenticated and low-complexity, with blind SSRF impact - connection establishment and internal enumeration rather than direct extraction of device data; no public exploit code or confirmed active exploitation was identified at time of analysis.
Frigate NVR deployments prior to 0.18.0 ship an nginx configuration that routes the prefix-matched location /api/go2rtc/api to the internal go2rtc API behind authentication but without an administrator role check, so any authenticated user holding only a low-privilege 'viewer' account can issue GET requests to that path and read proxied go2rtc data. Reachable subpaths (streams, config, log, stack) disclose internal network addresses, configuration file paths, application logs, goroutine stack traces, and RTSP stream URLs that may embed camera credentials; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) reflects remote, authenticated, read-only disclosure with changed scope, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. This is a genuine but bounded confidentiality issue: non-GET methods are rejected by limit_except GET, so no modification or lateral write is possible, the impact is contingent on RTSP URLs actually containing embedded camera credentials, and instances already upgraded to 0.18.0 are not affected. Authentication requirements are confirmed as authenticated by the CVSS vector (PR:L); unauthenticated attackers and administrators are outside the stated prerequisite set.
Integer overflow in libstdc++ within Red Hat Hardened Images can cause undersized memory allocations, leading to memory corruption or application instability when a consuming application passes an attacker-controllable large size to the C++ new or new[] operator. Exploitation requires a specific application input path that triggers CWE-190 and an exploitable heap layout, as reflected in the High severity (CVSS 7.7, AC:H) assigned by Red Hat; the flaw is not exploitable against libstdc++ in isolation. No public exploit code, proof-of-concept, or CISA KEV listing is identified in the available data.
A use-after-free in the Security Plugins component of RTI Connext Professional 7.6.0 through 7.7.0.0 lets an admitted, low-privilege participant in a DDS domain corrupt memory and manipulate files, producing high impact to confidentiality, integrity and availability. Exploitation is network-reachable but gated by two prerequisites: the deployment must have Security Plugins enabled (not just the base DDS libraries), and the attacker must already hold authenticated low-privilege access as an accepted DDS participant (CVSS 3.1 PR:L, CVSS 4.0 AT:P indicates an additional timing/precondition gate), so it is not exploitable against a default unauthenticated posture. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-supplied CVSS 4.0 base score is 7.7 (High).
Deserialization-based code execution is possible in MISP because PHP's phar stream wrapper is left registered in both the web entry point (app/webroot/index.php) and the console entry point (app/Console/cake.php), so any filesystem call on a caller-influenced path that resolves to a phar archive silently triggers an unserialize() of attacker-controlled metadata, or can reach executable code inside an uploaded phar under a relocated application root. The vendor's fix (commit 08fa755b6) simply unregisters the wrapper at startup, confirming that nothing in MISP, vendored CakePHP, or runtime libraries legitimately uses phar archives. Real-world risk is lower than the 7.7 CVSS 4.0 score suggests: the vector requires authentication (PR:L - a valid MISP account) and High attack complexity (AC:H), because no MISP/CakePHP/library code natively feeds a caller-influenced path into a phar-resolving operation, so a separate path-influence bug must be chained and no public exploit code has been identified at time of analysis.
Denial of service in Adobe Content Credentials - the Content Authenticity Initiative (CAI) Rust SDK (c2pa-rs) and its associated command-line tool - allows attackers to exhaust system resources when the library is used to parse or validate an attacker-supplied C2PA asset or manifest. The flaw is classified as uncontrolled resource consumption (CWE-400) with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): authentication and user interaction are not required, and impact is availability-only with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so real-world risk is driven mainly by exposure - a network-reachable exploit path exists only where the SDK is embedded in a service that ingests untrusted content credential files, while standalone command-line usage limits the vector to locally or pipeline-supplied assets.
Improper input validation in Adobe's Content Credentials Rust SDK and its companion command-line tool lets unauthenticated remote attackers supply a crafted asset or Content Credentials manifest that slips past the SDK's validation logic, bypassing the intended security control and allowing unauthorized write/forgery of Content Credentials provenance data. The defect is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but the impact is integrity-only - confidentiality and availability are unaffected (C:N/I:H/A:N) - so exposure is bounded to applications and workflows that actually invoke the SDK or CLI to validate attacker-supplied content, particularly those relying on these credentials for media authenticity or trust decisions. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or KEV data was supplied; Adobe's advisory (APSB26-147) is the authoritative source.
Memory exhaustion in Netdata versions prior to 2.11.0 allows a remote, unauthenticated attacker to inflate small, highly compressed WebSocket frames into large server-side allocations and, by repeating this across concurrent connections, drive the monitoring process to memory exhaustion and termination. The weakness sits in the unauthenticated WebSocket server's permessage-deflate handling, which is negotiated before authentication, so exploitation requires only network reachability to the default web listener (0.0.0.0:19999) - instances bound to localhost or shielded by firewalls are not reachable. Vendor-released patch: 2.11.0, which introduces a compressed-to-decompressed ratio cap; no public exploit code identified at time of analysis and no CISA KEV entry, but the independent assessment rates this a legitimate availability risk given the trivial trigger and the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Denial of service in YARA 4.5.8 occurs when libyara deserializes a crafted compiled rule file (.yrc): malformed external-variable pointers or an out-of-range type field are not validated in the yr_rules_load/yr_rules_from_arena path, resulting in an invalid free in yr_rules_destroy() or a wild pointer dereference in yr_object_create(). Only deployments that load compiled rules from untrusted or third-party sources are exposed, since the assessed vector requires a user or process to actively load the file (UI:R) and no authentication (PR:N); the realistic outcome is a process crash rather than code execution (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and the issue is not confirmed actively exploited (CISA KEV).
Unbounded memory growth in rpcbind allows remote, unauthenticated attackers to degrade or exhaust service availability by flooding the daemon with unique RPC requests that it records in statistics lists which are never pruned. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), an availability-only impact, and affects rpcbind as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4. No public exploit code was identified at time of analysis, and exposure is limited to hosts on which the rpcbind service (typically TCP/UDP port 111) is network-reachable, because the attack requires no authentication, no user interaction and no non-default configuration.
Remote, unauthenticated attackers who can reach the application endpoints of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can perform unauthorized actions because the software fails to properly authenticate requests and subsequently omits authorization checks. Affected deployments are those running versions 4.0.6.0 through 4.0.10.0 Interim Fix 064, including Operator 4.4.6+20260807.081800 and the 4.0.6.0 Refresh build, per the EUVD version list. Impact is confined to integrity - attackers can trigger unauthorized operations or modify data, but there is no confidentiality or availability consequence per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), and there is no public exploit identified at time of analysis, with EPSS at only 0.60% (47th percentile) and CISA SSVC recording no observed exploitation.
Denial of service in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift: unsafe reflection handling of externally controlled input lets an unauthenticated remote attacker (CVSS 3.1 AV:N/AC:L/PR:N/UI:N) drive the service into an availability failure, scored A:H with no confidentiality or integrity impact for a base score of 7.5. Deployments affected are the 4.0.6.x through 4.0.10.0 releases listed by IBM prior to the Interim Fix 064 level. Exploitation pressure currently looks low - EPSS is 0.60% (47th percentile), CISA's SSVC decision framework rates exploitation 'none' and automatable 'no', and no public exploit code has been identified at time of analysis - but the practical limiter is exposure rather than exploit difficulty, since this financial middleware is normally run inside controlled OpenShift clusters instead of the open internet.
Authenticated users with contributor-level access or higher on a WordPress site running the WP Travel Engine plugin 6.8.0 or earlier can force the plugin's wte_get_template helper, reachable through one of its shortcodes, to include and execute arbitrary server-side .php files, enabling sensitive data disclosure, access-control bypass, or code execution. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) rates attack complexity as high because full remote code execution is gated on the attacker being able to place an attacker-controlled .php file on the server for inclusion; without that upload primitive, impact is limited to including and executing pre-existing PHP files. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so exploitation requires an attacker who already holds a legitimate low-privilege account.
Information disclosure in HPE ALE management interface allows unauthenticated remote attackers to retrieve sensitive site hierarchy, infrastructure details, and client device information via specially crafted requests to internal endpoints. Despite the absence of exploitation telemetry, this is a high-priority remotely-exploitable exposure because the flaw requires no authentication, no user interaction, and low attack complexity; the primary limiting factor is network reachability to the management interface. No public exploit code exists at time of analysis, and the confidentiality impact is high with no integrity or availability effect (CVSS 7.5).
Unauthenticated SQL injection in ReactPress versions prior to 3.7.0 allows remote attackers to read arbitrary data from the underlying database by supplying crafted query-string parameter names to the API list endpoints for articles, comments, files, knowledge entries, and pages. Because the application interpolates those attacker-controlled names directly as SQL column identifiers while only parameterizing the values, no authentication, user interaction, or non-default configuration is required - any network-reachable ReactPress instance running an affected version is exposed, as reflected in the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5) and CWE-89 classification. Exploitation is limited to information disclosure through the injected LIKE clause (no integrity or availability impact has been demonstrated), and no public exploit code has been identified at time of analysis, with vendor-released patch version 3.7.0 available.
Blind SQL injection in the DevItems HashBar - WordPress Notification Bar plugin, affecting all versions through 2.0.3, lets an attacker who already holds a high-privilege WordPress session inject crafted SQL through a plugin parameter and infer database contents one bit at a time. Because the CVSS vector is PR:H, exploitation requires an administrator-equivalent account (or a role able to reach the affected HashBar parameter) rather than anonymous access, and the inference-based (blind) nature of the flaw means extraction is slow and noisy rather than a single-shot dump. There is no CISA KEV listing, no EPSS score, and no public exploit code referenced, so this is a post-authentication risk that is elevated mainly on sites where over-privileged accounts are shared or where the WordPress database holds data belonging to other applications - the vector's S:C scope change only materializes in that shared-database scenario.
MPXJ's MerlinReader (versions 5.5.5 through 16.4.1) creates a default-configured DocumentBuilder when parsing XML taken from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype declarations and external entities enabled, so a crafted database can coerce the parser into reading arbitrary local files when an application imports an untrusted Merlin file. The practical impact is bounded: per the vendor, MPXJ's downstream handling of the parsed XML means the file contents are unlikely to be exfiltrated, so this is effectively blind XXE (local file access, possible SSRF or parser DoS) rather than reliable data disclosure, which is why the independent assessment rates Confidentiality as Low despite the 7.5 HIGH base score, and the CVSS vector shows network reachability with PR:N/UI:N (unauthenticated, no user interaction beyond the file being processed by the host application). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; a vendor-released patch is available in MPXJ 16.4.1.
Unauthenticated data injection in HPE's Analytics and Location Engine (ALE) lets any attacker who can reach the ALE service socket send specially crafted input during connection setup and corrupt the data the component handles. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) - remote, low complexity, no credentials and no user interaction required, with impact confined to integrity; confidentiality and availability are unaffected. There is no indication of active exploitation (CISA KEV) and no public exploit identified at time of analysis, so the practical risk is driven by exposure: ALE is an internal enterprise WLAN analytics component, and instances whose listening socket is reachable from untrusted or flat network segments carry the greatest risk.
Path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, affecting builds from 4.0.6.0 through 4.0.10.0 Interim Fix 06 (Operator 4.4.6+20260807.081800), allows an unauthenticated remote attacker (PR:N/UI:N per the CVSS vector) to submit manipulated path input that the product fails to canonicalize and thereby read arbitrary files accessible to the FTM process. The impact is confidentiality-only - no write, code execution, or availability effect - and exploitation requires network reachability to the FTM application endpoint, so internal-only routes or network segmentation materially reduce exposure. A vendor patch is available via IBM's advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.35% (28th percentile), making this a moderate rather than urgent priority.
Server-side request forgery in MCP Atlassian (sooperset/mcp-atlassian) versions prior to 0.22.0 allows unauthenticated callers to reach internal or cloud metadata endpoints by exploiting a DNS-rebinding race, because the server validates a hostname's resolved IP and then lets Requests/urllib3 resolve that same hostname again at connection time. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N (7.5): no authentication is needed, but the attacker must control authoritative DNS for a low-TTL name that answers publicly during validation and privately during connection, and the server must actually be able to reach a valuable internal target for the attack to pay off. This is a bypass of the earlier CVE-2026-27826 hardening rather than a new class of bug, no public exploit code or confirmed active exploitation was identified at time of analysis, and environments already running 0.22.0 or with no reachable internal/metadata endpoints are not exploitable.
Sensitive information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stems from the product's use of a hard-coded or predictable cryptographic key (CWE-321). Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), an unauthenticated remote attacker who obtains that static key can read data the product intended to protect, with no integrity or availability impact. The real gate is acquiring or deriving the embedded key rather than defeating authentication: no public exploit identified at time of analysis, EPSS is only 0.26% (17th percentile), and CISA SSVC records exploitation as none with Automatable set to no, making this a moderate, not urgent, priority.
A one-byte heap buffer over-read in flatcc (commit 4c3b999e) allows an attacker to crash the schema compiler by supplying a malicious FlatBuffers schema that is exactly the length of the input buffer and ends with an unterminated quotation mark. The flaw requires local access and user interaction to feed the crafted schema into the parser, resulting in a single-process denial of service with no code execution or data disclosure. Publicly available exploit code exists, but the issue is not known to be actively exploited (not in CISA KEV); EPSS is 0.22% (13th percentile), indicating low predicted exploitation activity.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift exposes transaction data, credentials, or other confidential payloads to anyone able to observe network traffic on the same segment. The issue affects deployments of FTM for OpenShift where the relevant transport is not wrapped in TLS; an unauthenticated attacker with an adjacent-network position (per the assessed vector PR:N, AV:A) can passively capture that traffic, though a successful capture depends on the specific unencrypted channel being in use (AC:H), which is why the independently assessed impact is limited to confidentiality only. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation, so this remains a low-real-world-priority issue despite the headline 7.5 (High) CVSS score.
Supplying a FlatBuffers schema whose exact-length buffer terminates on a digit character pushes flatcc's schema lexer one byte past the end of the input, producing a single-byte heap over-read that crashes the process (denial of service). The defect lives in external/lex/luthor.c at flatcc commit 4c3b999e and requires the application to hand attacker-controlled schema text to lex(); in typical build-time and CI usage that input is local, so unauthenticated remote triggering only applies to services that compile or lex untrusted schemas at runtime (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:A:H). Impact is confined to availability - no memory write, no code execution and no data disclosure - and no public exploit identified at time of analysis.
Cleartext transmission of sensitive or security-critical data by IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a network-positioned attacker read that traffic by passively sniffing the communication channel, resulting in high confidentiality loss without any integrity or availability impact. Affected deployments span the 4.0.6.0 release line (including the 4.0.6.0.0.6.0 Refresh, Operator 4.4.6+20260807.081800) through 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 064. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit code has been identified; EPSS is low at 0.20% (10th percentile), and CISA's SSVC assessment records exploitation: none, automatable: no. The practical barrier is the attacker's required vantage point on the traffic path, which our assessment reflects by treating attack complexity as high (AV:N/AC:H/PR:N/UI:N) rather than the vendor-published AC:L, making this a moderate rather than top-tier priority; a vendor patch is available.
Message forgery in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets remote, unauthenticated attackers send messages bearing forged cryptographic signatures that the platform improperly accepts as authentic, undermining the integrity of trusted transaction messaging (CWE-347, CVSS 7.5, integrity-only impact with no confidentiality or availability loss). Affected releases are the 4.0.6.0 line, including Interim Fixes 1 through 6, plus 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 06. Exploitation is remote and requires no authentication or user interaction (PR:N/UI:N) but demands that an attacker understand and correctly craft a message in FTM's expected format and that an FTM message interface be reachable; there is no public exploit identified at time of analysis (EPSS 0.19%, 9th percentile), CISA SSVC rates exploitation as none and automatable as no, and there is no KEV listing.
Unauthenticated path traversal in the Dancer2 Perl web framework (versions 2.1.0 up to but not including 2.2.0) lets a remote attacker read arbitrary files that the worker process can access, including configuration files such as config.yml stored above public_dir. The flaw only manifests in a non-default deployment where the application names File in its route_handlers configuration and sets static_handler to 0 - because the default static handler refuses dot segments before the File route executes; applications left at defaults are not affected. The vendor has released Dancer2 2.2.0 with a containment fix, EPSS is low (0.19%, 8th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary code execution in GNU Emacs 28.1 through 31.1 is triggered simply by opening a crafted file: an untrusted read-symbol-shorthands value supplied by that file reaches the Lisp reader's intern and unintern functions and is honored under Emacs's default configuration, so no special user settings or opt-ins are required. Exploitation is bounded by delivery - the attacker must get a victim to open the malicious file locally (AV:L with UI:R), and any resulting code executes with the privileges of the user running Emacs; no network service, listener, or authentication is involved. The issue carries a CVSS 4.0 score of 7.5 and is assessed under CVSS 3.1 as AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, with high confidentiality, integrity, and availability impact and no public exploit identified at time of analysis.
OS command injection in OpenEye Apex Network Video Recorder firmware (2.2.3.4 through 3.2.9.376) allows an authenticated administrator to feed crafted backup-area configuration input into the recbackup routine, where it is passed unsanitized to a shell and executed with the privileges of the nvr service account. Rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the issue is genuinely exploitable but access-gated: the attacker must already hold an administrator account and reach the management interface over the network, which confines realistic exposure to insiders, credential-theft or credential-reuse scenarios, and NVRs left on default or weak admin passwords. No public exploit code or confirmed active exploitation has been identified at time of analysis; OpenEye has released firmware 3.5.4 as the fix, with supporting detail in vendor advisory 1061 and the Securifera advisory.
Security-control bypass in the Dancer2 Perl web framework (2.0.0 through 2.1.x) lets a refused route execute anyway: when an application enforces an authorization or security check by having a 'before' hook die and also registers an on_hook_exception handler that halts the response, the post-exception cleanup still runs and destroys the request, response and session the dispatcher needs, so the route body the hook meant to refuse runs and its writes land. The flaw requires that specific non-default application design - apps that do not refuse via dying hooks, or whose exception handler does not halt the response, are not affected - and, when the pattern is present, a single unauthenticated remote request is enough to trigger it (AV:N/AC:L/PR:N/UI:N), giving a high integrity impact on denial-protected state changes. EPSS is 0.17% (7th percentile) and there is no public exploit identified at time of analysis; CISA's SSVC rates exploitation as none, automatable as yes, technical impact partial. Vendor-released patch: Dancer2 2.2.0, which adds a halt check to the cleanup guard and makes hook compilation idempotent.
Information disclosure in Adobe Connect (server through 12.11 and Android mobile app through 4.4) stems from improper TLS certificate validation that lets an attacker who can intercept the connection present a forged certificate and induce the product to leak sensitive memory contents. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N with high confidentiality impact and no integrity or availability effect, reflecting that no authentication or user interaction is required once the attacker holds an active network-intercept position, which remains the hard prerequisite. No public exploit identified at time of analysis and no confirmed active exploitation; the EPSS score is 0.17% (6th percentile), so targeted rather than mass exploitation is the realistic concern.
Malformed UTF-8 passed directly to Perl's Net::IDN::Punycode encode_punycode() before version 2.590 can push the interpreter into an unending loop, abort the process, or return a Punycode label that encodes bytes the input never contained, depending on the Perl version and which backend is selected. Only code paths that call the low-level encoder itself on attacker-influenced, UTF-8-flagged byte strings are exposed, since the documented domain_to_ascii() and email_to_ascii() wrappers perform a Unicode property match first and die on such input, and the decoder is unaffected. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with an independent assessment adding I:L for the wrong-label case), EPSS is 0.16% at the 6th percentile, CISA SSVC records Exploitation: none and Automatable: yes with partial technical impact, and no public exploit is identified at time of analysis, although the upstream fix commits do include regression tests that reproduce the malformed-input condition.
CPU exhaustion in Net::IDN::UTS46 before version 2.590 lets a single crafted overlong IDN label consume disproportionate CPU, because to_ascii punycode-encodes each label before applying the 63-byte DNS length check and the RFC 3492 encoder's outer loop runs once per distinct non-ASCII code point while rescanning the whole label each pass. Remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability-only impact A:H) who can reach Perl code that normalizes untrusted hostnames or email addresses through to_ascii, domain_to_ascii, or email_to_ascii can stall a request or worker with one input string. No public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is low at 0.15% (5th percentile), so this is a genuine but bounded availability risk rather than a broadly exploited one.
CPU exhaustion in Net::IDN::Punycode before 2.590 lets unauthenticated remote attackers pin the CPU of a Perl application by supplying an over-long label to the to-Unicode decoder (domain_to_unicode or uts46_to_unicode), which performs quadratic work as it inserts each decoded code point. The flaw is availability-only (C:N/I:N) and requires no authentication, no user interaction, and no non-default configuration - the only prerequisite is that an application forwards attacker-controlled labels into the to-Unicode direction, since the 63-byte DNS length limit is enforced solely in the to-ASCII direction. A fix is available in the 2.590 release and in two upstream commits (00d7234, 447c6b3); no public exploit code was identified at time of analysis.
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an out-of-bounds write (CWE-787) in the affected firmware, producing a denial-of-service condition that can take the device offline or force a reboot. Tracked as CVE-2026-95862 with a CVSS 3.1 score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw is reachable over the network without credentials or user interaction, but its impact is confined entirely to availability - no confidentiality or integrity loss, and no code execution or data disclosure is indicated. Affected product families per the vendor's CPE data include Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways; so far there is no public exploit identified at time of analysis and the issue has not been marked as confirmed actively exploited (CISA KEV).
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways) allows an unauthenticated remote attacker reachable over the network to crash the device by triggering uncontrolled recursion (CWE-674), rated CVSS 3.1 base 7.5 HIGH with impact confined to availability (C:N/I:N/A:H). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials or user interaction are required and complexity is low; the practical gating factor is exposure of the affected service, so gateways with management/service interfaces reachable from the internet or untrusted networks are directly at risk while LAN-confined deployments are exploitable only by a host already on that segment. The outcome is limited to device crash/reboot with no data exposure or code execution; no public exploit identified at time of analysis and no KEV or EPSS data was provided.
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CWE-125) that crashes the device, producing a denial-of-service condition rated 7.5 HIGH. The issue affects the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7, and generic UniFi Gateway product lines, and no public exploit code was identified at time of analysis. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, user interaction, or special configuration are required - the practical constraint is network exposure, since the attack surface shrinks considerably if the vulnerable service is bound only to a trusted LAN or management interface rather than the WAN or untrusted segments.
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways) can be triggered by an unauthenticated network attacker who sends crafted input to a vulnerable interface, causing an out-of-bounds read (CWE-125) that crashes the device. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, but impact is limited to availability with no confidentiality or integrity loss. Exploitation requires the attacker to reach the exposed vulnerable service; if the affected parser listens only on LAN or management interfaces rather than the WAN, an internet-based attacker would need a foothold. No public exploit code or active exploitation has been identified at time of analysis.
Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways-allows unauthenticated remote attackers to crash the device, causing a denial of service. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact with no confidentiality or integrity loss. No public exploit identified at time of analysis; Ubiquiti Security Advisory Bulletin 069 provides remediation guidance.
Unauthenticated remote attackers who can reach the network-facing services of certain Ubiquiti UniFi gateway devices can trigger an out-of-bounds write that crashes the device, producing a denial-of-service condition (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The affected product lines span the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7 and general UniFi Gateway families, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exposure is bounded by network position: the CVSS vector confirms no authentication or user interaction is required, but the attacker must still be able to send traffic to the vulnerable service, so gateways whose attack surface is confined to trusted internal segments are materially less exposed than devices reachable from the WAN or other untrusted networks.
Remote, unauthenticated denial of service against applications running FasterXML jackson-core 2.17.0 through 2.18.10: a JSON string of attacker-supplied numeric-looking text coerced into a BigDecimal, BigInteger, Double, or Float target drives NumberInput.looksLikeValidNumber() into quadratic regular-expression backtracking, and a single 160,000-character value was measured at roughly 74 seconds, so a small number of concurrent requests of ordinary body size can exhaust a server's request-handling thread pool. Reachability is narrowed by the data-binding requirement: only endpoints where jackson-databind's StdDeserializer/NumberDeserializers perform String-to-number coercion are exposed, and 2.16.x and earlier do not contain the affected method at all. No public exploit code identified at time of analysis, and no CISA KEV confirmation of active exploitation.
Stored cross-site scripting in GitHub Enterprise Server (3.17 through 3.22 series) allows an authenticated user to inject arbitrary HTML attributes through crafted Markdown that survives initial sanitization but is then re-interpreted by the rendering pipeline's quote-character rewriting step, letting the payload chain same-origin JavaScript gadgets to bypass Content Security Policy and seize control of the page DOM in a victim's browser. When a second user views the rendered content, the attacker can read content visible to that victim, extract embedded CSRF tokens, perform state-changing actions as the victim, and exfiltrate data through same-origin writes, with the payload potentially propagating into any repository or organization where the victim holds write access. Exploitation requires an authenticated account and victim interaction (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, vendor score 7.4), no public exploit code has been identified at time of analysis, and vendor-released patches exist in 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21.
Heap-based buffer overflow in libslirp's DHCPv6 and TFTP reply builders lets a malicious guest write attacker-controlled content and length past the end of the host-side reply buffer, causing host process crashes (denial of service) and potentially arbitrary code execution in the host. The flaw only manifests when the host interface is configured with a small, non-default MTU - the default MTU is explicitly unaffected - and requires the guest to reach libslirp's built-in DHCPv6 or TFTP service, which makes this a guest-to-host escape surface for QEMU user networking and slirp4netns rootless containers. Red Hat Enterprise Linux 8, 9 and 10 and OpenShift Container Platform 4 ship affected builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector is unauthenticated (PR:N) but high complexity (AC:H) because of the configuration prerequisite.
Improper restriction of XML external entity references in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment - or elsewhere within the same cluster network - to read sensitive files and internal resources by submitting a crafted XML document to an FTM parsing endpoint. The assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) confirms the exploitation requirements: no credentials and no user interaction are needed, but the adjacent-network prerequisite rather than an internet-facing vector meaningfully narrows the attacker population, and impact is confined strictly to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis, no EPSS signal or CISA KEV listing is present in the provided data, and IBM has published a vendor advisory with a patch available for this CWE-611 flaw.