Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory traversal with a malicious file upload to place and execute arbitrary scripts, resulting in full loss of confidentiality, integrity, and availability on the management server (vendor-assigned CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is network-exploitable with no authentication and no user interaction, so the decisive real-world factor is exposure: these servers are normally confined to internal administrative networks, and risk rises sharply if the affected upload endpoint is reachable from an untrusted network. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and affected version ranges are not enumerated in the available data.
Remote code execution affects F5 BIG-IP systems that terminate traffic on a virtual server configured with both an APM (Access Policy Manager) access policy and an OAuth profile, where crafted malicious traffic can trigger a heap-based buffer overflow in the data plane. The flaw is remotely reachable, unauthenticated and low complexity per the vendor's CVSS 4.0 base score of 9.3, and the independent assessment confirms full confidentiality, integrity and availability impact (C:H/I:H/A:H) with no control-plane exposure; Appliance mode does not mitigate it. Exploitability is sharply limited by configuration - instances without APM or without an OAuth profile bound to a virtual server are not affected - and no public exploit code was identified at time of analysis, though the combination of unauthenticated RCE and a widely deployed enterprise appliance makes prompt hotfix deployment the priority.
Unauthenticated remote attackers can reach privileged internal functionality on customer-hosted (on-prem) Arista VeloCloud Orchestrator deployments, potentially compromising the confidentiality, integrity, and availability of the orchestrator itself and the data it manages. The vulnerable code path is exposed pre-authentication (PR:N) with no user interaction required, though the vendor's CVSS 4.0 vector and our independent assessment both assign high attack complexity (AC:H), indicating exploitation depends on specific conditions or non-trivial request crafting rather than a single trivial call. Arista-managed Hosted and Dedicated VCO instances have already been patched and are not at risk; only customer-run on-prem VCO appliances remain exposed, and no public exploit code has been identified at time of analysis.
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location Engine (ALE) allow an unauthenticated remote attacker to log straight into the management interface and the underlying operating system, yielding full compromise of the appliance. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because no authentication, user interaction, or special configuration is required - the attacker only needs the known default secrets, which are typically published in advisories or recoverable from firmware - and there is no CISA KEV listing or public exploit code reported at time of analysis. Practical exposure is tempered by deployment context: ALE normally sits inside enterprise WLAN/management networks rather than on the public internet, so real-world risk depends on an attacker already having a foothold or reachability into those internal segments.
Unauthenticated remote command execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 branch) lets attackers take root on the host and all managed VPS instances by exploiting the billing module handler. Publicly available exploit code exists, and exploitation requires only network reachability to the billing/panel interface-no authentication or user interaction. Vendor patches are available in 3.2.9 Patch 9 and 3.3.0, making immediate upgrade the top priority.
Missing authentication in the WebSocket Service of the Gigatech PDV5701 point-of-sale terminal (firmware 1.0.31_240305_112640, exposed via /index.html) lets unauthenticated remote attackers reach functionality that should require credentials, yielding full confidentiality, integrity, and availability impact with a CVSS 4.0 score of 9.3. Exploitation needs only network reachability to the device's WebSocket endpoint - no credentials and no user interaction (PR:N/UI:N) - though practical exposure is limited to attackers who can route to the terminal, which is typically deployed on a constrained retail or fiscal LAN rather than the public internet. Publicly available exploit code exists; there is no confirmed evidence of active exploitation (not in CISA KEV), and the vendor was contacted prior to disclosure but did not respond.
Stored/DOM cross-site scripting in the Home Assistant frontend Statistics Graph card lets an authenticated user or a malicious integration inject script-related HTML through an entity's default name, which is passed through getStatisticLabel and computeStateName and interpolated unescaped into ECharts tooltip HTML. The payload renders only when a separate victim hovers over an affected data point in a default Line chart (Bar charts are not affected), so exploitation needs low-privilege authenticated access plus victim interaction, and is therefore rated CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N rather than the vendor-published 9.3 base. No public exploit code or confirmed in-the-wild exploitation has been identified, and the flaw is fixed in Home Assistant 2026.7.0.
Remote code execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 line) allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting a PHP object injection flaw in the billing module handler, where untrusted serialized data in the billing_data POST field is passed to unserialize() without allowed_classes restrictions. Publicly available exploit code exists. Our assessment rates this 9.8 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N), while the vendor's CVSS 4.0 score is 9.2 (AC:H), reflecting the dependency on a reachable POP chain; no authentication or user interaction is required.
Hard-coded credentials in LTSecurity LTK3500SF devices allow unauthenticated remote attackers who can reach Telnet or SSH to recover the root and guest passwords from reversible hashes in /etc/shadow and obtain full root-level operating system access. The affected firmware is AC3F_V1.1.0_build191121, and because the hashes are weak/reversible and identical across units, one successful cracking effort can compromise any reachable device. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV); EPSS is 0.51%, and real-world risk is bounded by the narrow deployment base and management-service exposure.
Remote code execution in D-Link DAP-1360 firmware 6.14 and earlier allows unauthenticated attackers to execute arbitrary commands as root via crafted requests to the web management interface. Exploitation requires only network reachability to the device's HTTP management interface-no credentials, user interaction, or non-default configuration-and publicly available exploit code exists, making this a high-priority risk for exposed devices. Successful compromise enables persistent configuration changes and use of the device as a pivot into the local network.
An out-of-bounds write in the MQTT client module of the lwIP TCP/IP stack lets an adversary who controls or impersonates the MQTT broker that a device connects to corrupt heap/stack memory and potentially achieve full code execution on that device. Only devices built with lwIP's optional MQTT client compiled in are exposed, and because MQTT connections are client-initiated the device is not directly reachable inbound: the attacker must operate a malicious broker, compromise the legitimate broker, or hold a man-in-the-middle position on the client-to-broker path (feasible where TLS is absent or certificate validation is disabled). No authentication or user interaction is required once that broker-side position is achieved, but no public exploit code has been identified at time of analysis and no CISA KEV listing exists; the vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N) presents this as trivially exploitable, whereas the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the significant broker-control/MITM prerequisite.
Arbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attackers run code in the context of the running ACC service. The vendor's CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) marks it as maximum severity: network-reachable, low-complexity, unauthenticated, requiring no user interaction, with a scope change and full loss of confidentiality, integrity, and availability. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis, so the practical exposure driver is whether an unpatched ACC instance is reachable over the network.
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary code in the context of the affected process, and the CVSS 3.1 base score is the maximum 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with scope changed, meaning a successful compromise can cross the component's security boundary and affect resources beyond its intended authority. No user interaction and no authentication prerequisite are required, so the practical exposure is driven almost entirely by whether an ACC instance is reachable from untrusted networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the structural severity signals make this a top-priority patch item; Adobe's bulletin APSB26-142 is the authoritative source for fixed builds.
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arbitrary code in the context of the current user, as described by the vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (score 10.0). The flaw is a CWE-94 code injection issue tracked via CPE cpe:2.3:a:adobe:adobe_campaign_classic, with exact vulnerable and fixed builds enumerated only in Adobe advisory APSB26-142, which the provided data points to but does not quote. No public exploit code and no confirmed active exploitation were identified at time of analysis, but because exploitation requires no authentication and no user interaction, any ACC instance reachable from untrusted networks should be treated as high risk.
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to execute arbitrary code with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); no user interaction is required, and the scope change means impact is not necessarily confined to the vulnerable component. The affected version range and fixed build are not enumerated in the available intelligence, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, so risk is currently driven by structural severity rather than observed attacks. Because ACC is an internet-reachable marketing automation platform that typically stores customer data and holds credentials for downstream systems, this should be treated as a top-priority patch item even though corroborating sources are limited to Adobe's own advisory.
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems running Adobe Campaign Classic, tracked as CVE-2026-73369, per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C with a base score of 10.0 (CWE-94 code injection). Exploitation requires no authentication, no user interaction, and no confirmed special configuration; the vector's changed scope (S:C) means the compromise can affect resources beyond the vulnerable component's security authority, though the code itself runs as the current application user rather than as a privileged system account. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue, but the impact, the low attack complexity, and the two practical limiting factors - network reachability of the ACC instance and the currently unspecified affected version range (CPE is a wildcard) - make this a genuine top-tier priority for any deployment confirmed affected by Adobe advisory APSB26-142.
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current user, carrying a maximum-severity CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with no user interaction required under the vendor vector. The CPE data flags the product with a wildcard version, so the specific affected release range is not enumerated in the supplied intelligence, and Adobe's advisory (APSB26-142) is the only reference. Exploitation status: no public exploit identified at time of analysis; independent analysis cautions that the advisory is sparse and that the description's 'current user' wording may imply an existing session context, so the PR:N unauthenticated rating should be confirmed with Adobe.
Incorrect authorization in Adobe Experience Manager Forms JEE (the 6.5 and 6.5 LTS branches) allows a remote, unauthenticated attacker to bypass intended access controls and execute arbitrary code in the context of the running AEM service account, with no user interaction required. The scope-change (S:C) rating and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H produce a maximum 10.0 base score, reflecting that successful exploitation can affect resources beyond the vulnerable component itself. Exposure is limited to deployments where the Forms JEE component is installed and network-reachable - typically internet- or intranet-facing AEM Forms servers - and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) was identified, though the pre-authorization nature of the flaw makes it an attractive target for rapid weaponization.
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that should have been access-controlled, achieving arbitrary code execution in the context of the current application user without any user interaction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) reflects a scope-changing flaw, meaning the vulnerable component can affect resources beyond its own security boundary - a combination that makes this a genuine top-priority vulnerability for any internet- or partner-reachable ACC deployment. As of analysis there is no CISA KEV listing and no public exploit identified at time of analysis; Adobe's advisory APSB26-142 is the authoritative source for affected and fixed builds.
SQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which Adobe states could lead to arbitrary code execution in the context of the current user and potentially account or session takeover. The vendor scores this 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment agrees on the high confidentiality, integrity, and availability impact while treating the scope change as unconfirmed (S:U) rather than vendor-asserted S:C. The key limiting factor is the PR:L prerequisite: a valid low-privileged Adobe Connect account is required, so anonymous internet attackers cannot exploit it directly, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Both the Adobe Connect web application and the Adobe Connect Android mobile app appear in the affected CPE set, indicating mobile sessions may reach the same vulnerable surface.
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app - arises from improper input validation that an unauthenticated, network-positioned attacker can trigger by inducing a victim to open a crafted URL or interact with a compromised web page. Exploitation runs attacker-supplied code in the context of the current user, so the practical blast radius is bounded to that user's session and privileges rather than the underlying server host, even though the published CVSS 3.1 base score is 9.3 (Critical) on account of the scope change (S:C) and the high confidentiality/integrity ratings; our independent assessment scores confidentiality and integrity impact as Low because the mandatory victim click and user-context execution materially restrict reach. There is no public exploit identified at time of analysis, and exploitation requires user interaction (UI:R) with no drive-by or fully automated path.
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a persistent JavaScript payload into a vulnerable form field execute script in the browser of any victim who later browses to the page rendering that field. Adobe rates the flaw Critical (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), but the independent assessment tempers this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N because exploitation requires a mandatory victim page visit and the impact is confined to the victim's browser session/account context rather than server compromise. Authentication to reach and submit into the storable form field is contested - the vendor vector indicates PR:N while the assessment finds the form-submission step is typically an authenticated operation (PR:L) - and no CISA KEV listing, public exploit code, or EPSS signal appears in the supplied intelligence, so there is no public exploit identified at time of analysis.
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers to inject malicious scripts into a victim's browser session via a crafted URL. Exploitation requires user interaction (UI:R), and impact is limited to the victim's browser context, potentially enabling session hijacking or data theft within the victim's privileges; no server-side code execution is possible. No public exploit identified at time of analysis, and Adobe rates this as 9.3 Critical, though the assessed CVSS vector indicates partial confidentiality and integrity impact (C:L/I:L).
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malicious JavaScript inside a vulnerable form field, which then executes in the browser of any user who later browses to the page rendering that field - enabling session or account takeover inside the victim's browser context. Adobe rates the flaw 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent analysis assesses it more conservatively as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because the injection step realistically requires prior authenticated content-submission or authoring access and a victim must still be drawn to the affected page; impact is bounded by the victim's browser session rather than direct server compromise. There is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields, which then execute in a victim's browser when the victim browses to the page rendering that field (CVE-2026-75697). The vendor-assigned CVSS 3.1 score is 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating remote, unauthenticated injection with required victim interaction and a scope change that reflects script execution in the victim's browser context, potentially leading to session or account takeover. Both the Adobe Connect web application and the Adobe Connect Android Mobile App are listed as affected; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Unauthenticated remote attackers can completely compromise the web management portal of Lantronix console servers, reading sensitive configuration files, writing files to arbitrary filesystem locations, and ultimately achieving remote code execution. Affected are SLC8000 units below firmware 9.7.0.5, EMG8500/EMG7500 units below firmware 9.7.0.1, and SLB882/SLCx-03/SLCx-02 devices, which are vulnerable in every firmware version released to date. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; vendor CVSS 4.0 score 10.0) requires nothing more than HTTP reachability to the portal upload endpoint - no credentials, user interaction or non-default settings - and exploitation yields total loss of confidentiality, integrity and availability on the device plus potential impact on serial-connected downstream equipment; no public exploit code has been identified at time of analysis, though a third-party technical writeup accompanies the disclosure.
Unauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a network-reachable attacker execute arbitrary operating system commands on the host, enabling code execution, data tampering, denial of service, and information disclosure. Per the NVIDIA-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), no credentials or user interaction are required, so an exposed controller interface is directly attackable; CISA's SSVC assessment rates technical impact as total, though exploitation has not been observed and the decision framework does not classify the issue as automatable. No public exploit code has been identified at time of analysis, and EPSS places the short-term exploitation likelihood at 2.10% (81st percentile) - elevated relative to the broader corpus but not indicative of active campaigns.
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauthenticated attackers induce the ACC server to issue arbitrary requests to other systems, which the vendor rates as a privilege-escalation risk with a changed scope and a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No authentication or user interaction is required per the vendor vector, so the practical limiting factor is whether the ACC endpoint is reachable by the attacker and whether exploitable internal services sit behind it; Adobe does not document a non-default configuration prerequisite, so default deployments in the affected range appear exposed. Exploitation status at time of analysis is that no public exploit has been identified, and EPSS is a modest 0.69% (51st percentile), though the vendor's high impact rating and the absence of preconditions justify prompt patching. An independent recalibration prefers C:H/I:L/A:N over the vendor's triple-high impact, so the 10.0 figure should be read as Adobe's upper-bound claim rather than a confirmed blast radius.
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the context of the current user without any victim interaction, because the platform fails to properly validate input reaching an exposed processing component. The flaw scores 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and its scope change means a successful exploit can affect resources beyond the vulnerable component, raising the blast radius for confidentiality, integrity, and availability. The decisive prerequisite is authentication: per the assessed vector (PR:L), any valid low-privilege ACC account that can reach the component over the network is enough, but a fully anonymous remote attacker cannot trigger it; there is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so the exploitation signals remain thin even though the severity math is high.
Unauthenticated network clients that can reach an mcp-atlassian server running in HTTP (streamable-http) transport mode can invoke Atlassian tools using the operator's globally configured Jira or Confluence credentials, inheriting that account's read and write access to both products. The flaw is an authentication deficiency (CWE-287) in which the request path through UserTokenMiddleware, AtlassianOpaqueTokenVerifier, and _get_fetcher accepts a request without a verified user identity and falls back to the shared, operator-scoped credential set; exploitation requires no authentication (PR:N), user interaction, or special privilege once the endpoint is reachable, which is why the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (10.0). Exposure is limited to the shared-credential/multi-tenant deployment pattern - stdio-transport installs and per-user token deployments that never fall back to global credentials are not affected - and at the time of analysis no public exploit code had been identified and the issue was not confirmed actively exploited (CISA KEV).
Code injection in Adobe Campaign Classic allows an authenticated attacker holding only a low-privileged account to execute arbitrary code on the server in the context of the current user, with no user interaction required (CVSS 9.9, Critical). The flaw is network-reachable and low-complexity, but the required low-privilege account is the primary limiting factor - this is not exploitable by fully unauthenticated remote attackers, unlike some sibling Adobe Campaign issues. No public exploit code and no confirmed active exploitation were identified at time of analysis; Adobe has published a security advisory (APSB26-142) for the issue.
SQL injection in Adobe Campaign Classic allows an authenticated low-privileged user to execute arbitrary code in the context of the current user, with no victim interaction required, carrying a CVSS base score of 9.9. The vulnerability is exploitable over the network with low attack complexity (AV:N/AC:L/PR:L/UI:N) and is rated Scope Changed, meaning a successful attack can escape the ACC application boundary and affect the underlying database or host rather than remaining confined to the web tier. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the credential-only precondition and the low privilege bar make this a priority fix for any broadly provisioned or externally reachable Campaign Classic instance.
Server-side request forgery in Adobe Campaign Classic lets an authenticated, low-privileged user force the ACC application server to issue requests to internal or otherwise unreachable resources, turning the account into a foothold for reading confidential internal services (CWE-918; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). Adobe scores the issue 9.9 Critical, while our assessment keeps the scope change and high confidentiality impact but rates integrity as Low - the dominant effect is unauthorized reach into internal resources rather than direct tampering with protected data - which places effective risk in High territory (≈8.5) rather than Critical. Exploitation requires valid low-privileged ACC credentials and network reachability to the application, needs no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift fails to properly validate symbolic links, allowing an authenticated remote user to read files outside the intended path and disclose sensitive information held by the financial platform. The affected code path is reachable across the network (AV:N) but requires a valid FTM session (PR:L), and no public exploit code or confirmed active exploitation has been identified at time of analysis. IBM has published a vendor patch via its support portal; while the vendor-assigned CVSS of 9.9 implies a scope-changing, high-integrity and high-availability impact, independent analysis of the described weakness assesses it as an information-disclosure issue (file read) rather than full system compromise.
Server-side request forgery in Adobe Campaign Classic (Classic v7), affecting builds up to and including 7.4.4 build 9401, lets an authenticated low-privileged user coerce the ACC server into making requests to internal systems the user cannot reach directly, with the trust-boundary crossing reflected as a scope change (S:C) that can escalate that user's effective access. No user interaction is required, and Adobe rates the issue 9.9, while our independent assessment retains high confidentiality impact but lowers integrity and availability to Low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and stresses that a valid low-privileged account is a prerequisite, so this is not remote-unauthenticated. No public exploit code and no CISA KEV entry have been identified at time of analysis, EPSS is low at 0.73% (53rd percentile), and SSVC marks the issue non-automatable with total technical impact - making the realistic risk targeted insider or post-foothold abuse rather than opportunistic internet-wide scanning.
Arbitrary server-side code execution in the Plone process is possible through the Classic portlet shipped in plone.app.portlets 5.0.0 through 7.0.1, where user-supplied template and macro fields are assembled into a TALES path expression and then evaluated by the TAL path() helper, allowing a crafted value to be interpreted as a full expression rather than a constrained path. Any authenticated user who can add or edit a Classic portlet can execute code, and under Plone's default role map that includes ordinary registered users on their personal dashboard, so the issue amounts to a post-authentication privilege escalation across the trust boundary between a web user and the server-side Plone process (CVSS 3.1 9.9, scope changed: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). There is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, but vendor patches are available in 5.0.8, 6.0.4, and 7.0.2.
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid account plant special elements in a DataStage input path that are passed unsanitized into an operating-system command, resulting in arbitrary command execution with the privileges of the DataStage service. The prerequisite is a legitimate authenticated session (CVSS PR:L) on a network-reachable instance (AV:N/AC:L, UI:N), which limits realistic exposure to authorized users, compromised credentials, or malicious insiders on unpatched 5.4.0.0 deployments. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), but the vendor rates impact at 9.9 and a vendor patch is already available, so urgency is driven mainly by patch adoption rather than observed exploitation.
A stack-based buffer overflow in the RTI Connext Professional Core Libraries lets a remote, unauthenticated attacker corrupt memory by sending a crafted message to a reachable Connext/DDS endpoint, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rates the result as high impact across confidentiality, integrity, and availability with scope change. Affected builds are Connext Professional 7.4.0 before 7.7.0.1, 7.0.0 before 7.3.1.6, and the legacy 6.1.0, 6.0.0, 5.3.0, 5.2.0, and 4.3x branches before their respective fixed releases; systems already on 7.7.0.1 or 7.3.1.6 (or later fixed builds) are not exploitable. The CVE carries a CVSS 4.0 base score of 10.0, and there is no public exploit identified at time of analysis, although the real-world exposure is bounded by the fact that DDS deployments are commonly placed on segmented or isolated real-time data-bus networks rather than the public internet.
Remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated network attacker run arbitrary code on affected deployments. The flaw is CWE-94 (improper control of code generation): user-controlled input is passed into a JavaScript `new Function()` constructor without neutralization, so injected input is compiled and executed as code. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) no credentials, privileges, or victim interaction are required - only network reach to the vulnerable code path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the practical limiting factor is exposure, since the specific input-handling routine must be reachable and FTM's narrow financial-services enterprise footprint constrains the target population.
Unauthenticated remote code execution is possible in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the product improperly deserializes untrusted data (CWE-502), allowing a remote attacker who can reach a vulnerable endpoint to execute arbitrary code with the privileges of the affected service. IBM rates the flaw CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction and only network reachability are required, so any default-exposed FTM instance is at risk; the practical limiting factor is exposure, since FTM is specialized financial middleware normally deployed inside enterprise OpenShift clusters rather than on the public internet. Patch available per vendor advisory; no public exploit identified at time of analysis (no CISA KEV listing and no POC reporting in the available intelligence), though deserialization RCE is a well-understood and reliably weaponizable bug class once reachability exists.
Authenticated command injection in Lantronix out-of-band console managers (SLC8000, EMG8500/EMG7500, SLB882, SLCx-03, SLCx-02) allows any logged-in user - no administrative rights required - to execute arbitrary shell commands as root by abusing an undocumented 'mfc eeprom write' CLI command whose parameter is passed unsanitized into a system() call. Successful exploitation yields complete loss of confidentiality, integrity, and availability on the device itself, and, because these are serial/console aggregation appliances, can extend to downstream serial-attached equipment (CVSS v4.0 base 9.4; independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exposure is gated by prerequisites: a valid account of any privilege level plus network reachability to the terminal or CLI/console interface are required, and there is no public exploit identified at time of analysis - though the technical barrier is low for anyone who already holds credentials. Remediation is available for SLC8000 (9.7.0.2R1) and EMG8500/EMG7500 (9.7.0.1R2), but SLB882, SLCx-03, and SLCx-02 have no fix in any firmware version and require compensating controls.
Authenticated OS command injection in Lantronix out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) allows any user holding valid CLI or terminal credentials - not necessarily administrative - to execute arbitrary shell commands as root through the undocumented 'mfc eeprom read' command, which passes an unsanitized parameter directly to a system() call. CVSS 9.4 with scope-changed impact (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects total loss of confidentiality, integrity and availability on the appliance itself and plausible follow-on compromise of serial-attached downstream devices reachable through its console ports. Exploitability is gated by network reachability of the management interface plus valid low-privilege credentials; no public exploit code has been observed at time of analysis, but a public technical write-up lowers the discovery barrier, and the SLB882/SLCx-03/SLCx-02 model lines have no vendor fix.
Remote code execution in Qualcomm Snapdragon-based products allows unauthenticated network attackers to bypass authorization through the SocketIO interface and execute arbitrary code. The vulnerability carries a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact, and no public exploit was identified at time of analysis. Exploitation is constrained primarily by whether the SocketIO endpoint is network-reachable, because exact affected firmware versions and default exposure state are not specified in the available data.
Unauthenticated remote code execution affects SolarWinds Observability Self-Hosted installations that are running in a non-default and non-secure configuration, allowing an attacker who can reach the service to execute arbitrary code with no credentials and no user interaction. The root cause is insufficient integrity checking (CWE-345): when the insecure configuration is present, integrity validation that would otherwise block attacker-supplied content is weakened or bypassed. SolarWinds scores the issue 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that base score does not reflect the environmental gate - default and hardened deployments are not exploitable, so real-world exposure is confined to operators who have deviated from the vendor's documented secure-configuration guidance; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote write access to the file system with elevated privileges in HPE Analytics and Location Engine (ALE) lets any attacker who can reach the product's internal administrative component overwrite files as a privileged user, with the potential for full system compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction, and no special privileges are required against a vulnerable instance; the practical constraint is network reachability, since ALE admin interfaces are normally confined to internal management networks rather than exposed to the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the combination of an authentication-bypass class defect, a critical severity rating, and privileged file-write impact makes this a genuinely high-priority remediation item wherever ALE is deployed.
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated remote attacker who possesses the embedded secret log in to the controller's management interface and obtain full control, resulting in privilege escalation, data tampering, denial of service, and information disclosure; the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-798). Because the embedded credential itself is the authentication mechanism, no pre-existing account is required, but practical exploitation depends on the controller being network-reachable and on the attacker extracting or knowing the hard-coded value from the firmware/image or documented defaults. There is no public exploit identified at time of analysis and the product is not listed in CISA KEV, though the specialized datacenter/DPU infrastructure-management role of this component means exposure is typically limited to segmented management networks rather than the public internet.
Authenticated command injection in Lantronix SLC8000 console servers (before firmware v9.7.0.3), EMG8500/EMG7500 (before firmware v9.7.0.1), and the SLB882/SLCx-03/SLCx-02 families lets any account holding the 'services' permission run arbitrary shell commands as root via the 'set script schedule' CLI/terminal command, producing a complete loss of confidentiality, integrity and availability on the device and potentially on serial-attached downstream equipment. The vector is network-reachable and requires no user interaction, but it is gated behind a privileged role (PR:H) and reachability of the management/CLI plane, which limits practical exposure to devices whose out-of-band interface is exposed or improperly segregated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches exist for the SLC8000 and EMG models while SLB882/SLCx-03/SLCx-02 remain unpatched in all firmware versions per available data.
Root-level command injection in Lantronix console servers - SLC8000, EMG8500, EMG7500, SLB882, SLCx-03 and SLCx-02 - lets an authenticated user who holds the 'services' permission run arbitrary shell commands as root by abusing the 'set nfs download' command, whose parameter is passed unsanitized into a system() call, resulting in complete loss of confidentiality, integrity and availability on the device and potential downstream impact on serial-attached equipment. The privilege gate (PR:H) means anonymous or low-privilege users cannot trigger it and no user interaction is required once that role is held; authentication requirements are confirmed as privileged/authenticated by both the CVSS 4.0 vector (PR:H) and our assessed CVSS 3.1 vector (PR:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity-but-not-currently-exploited defect. Lantronix has shipped firmware v9.7.0.3R3 for SLC8000 and v9.7.0.1R2 for EMG8500/EMG7500, while no fixed build has been published for SLB882, SLCx-03 or SLCx-02.
Authenticated command injection in Lantronix console/out-of-band management appliances (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) lets an attacker who already holds the 'services' permission reach the terminal or CLI interface and run arbitrary shell commands as root via a crafted `set cifs password` argument, resulting in complete loss of confidentiality, integrity and availability on the device and possible cascading impact on serial-attached downstream equipment. CVSS 4.0 rates this 9.4 (Critical) on an AV:N/AC:L/PR:H/UI:N vector with full VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) agrees on severity. The vendor has shipped patched firmware for SLC8000 (9.7.0.2) and for EMG8500/EMG7500 (9.7.0.1), while SLB882, SLCx-03 and SLCx-02 have no fix identified in any firmware version; no public exploit code was identified at time of analysis, and CISA KEV does not list this issue.
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows remote, unauthenticated attackers to reach a privileged operation without credentials, enabling data tampering, denial of service, and information disclosure. The vendor-assigned CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), and the independent assessment concurs, meaning no authentication, no user interaction, and no special complexity are required against a network-reachable instance; the practical limiting factor is exposure, since this is a specialized AI/HPC datacenter management component usually confined to internal management networks. There is no public exploit identified at time of analysis and EPSS is low at 0.41% (35th percentile), though CISA SSVC rates technical impact as partial and automatable exploitation as 'no'; the specific critical function lacking authentication is not named in the available data.