Unauthorized read access to book records in TaleLin lin-cms-spring-boot 0.2.1 and earlier is possible through the searchBook function in BookController.java; remote unauthenticated attackers can reach the book endpoint and retrieve records without proper authorization. A publicly available exploit exists, but there is no confirmed active exploitation (CISA KEV) and no vendor patch identified. The 6.9 CVSS 4.0 score reflects a confidentiality-only impact; our assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, making real-world risk low-to-moderate and dependent on whether the book endpoint is network-exposed.
Improper authorization in TaleLin lin-cms-spring-boot through 0.2.1 lets unauthenticated remote attackers read book records by invoking the getBooks function in BookController.java; the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) confirms no privileges or user interaction are required, and impact is limited to confidentiality. Publicly available exploit code exists, and the vendor did not respond to early disclosure, so no vendor-released patch was identified at time of analysis. This is a real but low-severity issue that should be triaged as low-to-moderate priority, with the primary limiting factors being the product's rarity and the read-only scope of the exposure.
Improper authorization in TaleLin lin-cms-spring-boot 0.2.1 and earlier lets remote unauthenticated attackers read book records they are not entitled to by manipulating the ID argument supplied to the BookController.getBook endpoint (CWE-285, an object-level authorization gap equivalent to an IDOR). Exploitation requires no authentication, no user interaction and no non-default configuration, and publicly available exploit code exists, though the impact ceiling is low - read-only disclosure of book data with no integrity or availability effect. The issue is not listed in CISA KEV, and the maintainer did not respond to the VulDB disclosure, so no patched version has been identified.
Server-side request forgery in the chat-server component of songxinjianqwe Chat (ChatServer.java) allows remote, unauthenticated attackers to coerce the server into issuing HTTP requests to attacker-chosen URLs. The flaw is reachable over the network with low complexity and no user interaction (CVSS:4.0 AV:N/AC:L/PR:N/UI:N), but all impact metrics are rated Low (VC:L/VI:L/VA:L) with no downstream-system impact, so practical damage is limited to constrained or blind SSRF-style information leakage and internal-network probing rather than full internal pivoting. Publicly available exploit code exists (referenced from a GitHub issue), and VulDB reports that the vendor was contacted but did not respond; the project uses a rolling release model, so no specific fixed version is documented. Affected deployments are typically hobbyist Java chat-server instances rather than internet-exposed production services.
SQL injection in java110 MicroCommunity (through version 2.0) allows remote attackers to inject arbitrary SQL through the fallBackSql argument of the fallBack API endpoint implemented in BusinessApi.java / QueryServiceSMOImpl.fallBack. Publicly available exploit code exists (published as a Gitee issue), and because CVSS 4.0 carries PR:N, exploitation is claimed to need no authentication - though an independent assessment notes the endpoint may in practice sit behind application authentication, which would narrow real-world exposure. The project has not responded to the report, so no vendor fix is identified, and the CVE is not listed in CISA KEV, meaning confirmed active exploitation has not been established.
Improper neutralization of Spring Expression Language (SpEL) input in halo-dev Halo versions up to 2.25.4/2.26.1 lets unauthenticated remote attackers influence expression handling through the comment reply-notification subscription component, producing low-level confidentiality, integrity, and availability impact. Publicly available exploit code exists and the vendor did not respond to disclosure, but there is no CISA KEV listing, so active exploitation is not confirmed. The independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, a genuine but modest-severity issue.
Snipe-IT versions prior to 8.7.0 are affected by stored cross-site scripting in the uploaded-files API: an authenticated user with file-management access can upload an XML attachment carrying an xml-stylesheet reference and then request it through GET /api/v1/{object_type}/{id}/files/{file_id}?inline=true, which the API controller serves with Content-Disposition: inline without the safe-inline allowlist enforced by the equivalent web controller. Because the XML/XSLT is rendered in the Snipe-IT origin, an authorized victim who opens the attachment URL runs attacker-generated JavaScript under their own session, enabling same-origin data reads and authenticated actions with the victim's privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, base 8.7) confirms network reachability, an authenticated attacker, required victim interaction, and a scope change, but exploitation is bounded by the attacker's existing upload privileges and by the need for a separately authorized victim to open the link; no public exploit code or confirmed active exploitation was identified at time of analysis. Fixed in 8.7.0.
Out-of-bounds write in the rp-l2tp component of D-Link DIR-825 firmware 3.00b32 allows a remote, unauthenticated attacker to corrupt memory by sending a crafted L2TP Host-Name AVP, with the CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity, and availability impact. The flaw resides in tunnel_set_params() in tunnel.c, where the peer_hostname argument is copied without adequate bounds validation, so an oversized or malformed value overwrites adjacent memory; because the vulnerable code sits in the L2TP tunnel setup path, an attacker only needs network reachability to the router's L2TP service and no credentials or user interaction. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the severity and low attack complexity make the exposure significant for any deployment that leaves L2TP enabled on a WAN-facing interface.
Authorization bypass in the ixo Blockchain x/bonds module (all versions before v8.0.0) lets any unauthenticated remote account move another user's token balance into an attacker-controlled bond by simply adding the victim's blockchain address as a verification method on a DID the attacker owns - no victim keys, signatures, consent, or prior system compromise are required. The flaw affects the MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap and MsgWithdrawShare handlers plus the bonds batch order processor and its EndBlocker, and the vendor advisory reports the technique was exploited on ixo mainnet (ixo-5) on 2026-06-20, with the proceeds later withdrawn and bridged off-chain. With a CVSS 9.3 rating, PR:N/UI:N reachability, and every account holding a balance in a bond-usable token in scope, this is a genuine top-priority issue rather than a high-score-but-low-real-risk case.
Unauthenticated account creation in the MasterStudy LMS WordPress plugin (versions 2.3.0 through before 3.7.50) lets remote attackers create user accounts - and be logged into them - on WordPress sites where the administrator has deliberately disabled user registration. The plugin's front-end registration flow fails to consult the site's registration setting before creating the account (CWE-862, missing authorization), so the restriction the administrator put in place is simply not enforced; publicly available exploit code exists, though there is no confirmation of active exploitation (no CISA KEV listing, and CISA's SSVC assessment records exploitation as 'none'). Exploitation is unauthenticated and needs no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), but the impact is capped at subscriber-level account creation with no confidentiality or availability effect, making this a genuine but low-to-moderate priority issue.
Improper TLS certificate validation in the eufy Omni C20 robot vacuum allows an attacker who has already obtained a man-in-the-middle position on the device's network path to present a forged certificate, hijack the connection, and ultimately execute arbitrary code on the device. The flaw carries a vendor/NVD CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), but the independent assessment re-rates it as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L because exploitation is unauthenticated and requires no user interaction yet is gated on a privileged network position - hostile or shared Wi-Fi, a rogue access point, or ARP/DNS spoofing on the LAN path - meaning a purely off-path remote attacker cannot trigger it. Reported through CISA ICS-CERT (ICSA-26-267-02); no public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status. Devices that only ever connect to trusted, isolated home networks face substantially lower exposure than those on public, guest, or shared networks.
Missing authorization in the ServiceNow AI Platform lets unauthenticated remote attackers, under certain vendor-undisclosed instance conditions, read instance data beyond the intended scope and escalate privileges. ServiceNow has remediated the flaw on its hosted instances and distributed the fix to partners and self-hosted customers, but no public exploit code or active exploitation has been reported and no EPSS score was supplied with the source data. The vendor CVSS 4.0 rating is Critical (9.3), while the independent assessment is lower and treats exploitation as conditional, so unpatched self-hosted or partner-managed instances should still be prioritized given the data-exposure and privilege-escalation potential.
Unauthenticated SQL injection in the ServiceNow AI Platform allows remote attackers to execute arbitrary SQL statements against an instance's underlying database, potentially reading or altering instance data beyond its intended scope. ServiceNow has already remediated its hosted instances and shipped the update to partners and self-hosted customers, so residual exposure is confined to self-hosted or partner-managed deployments that have not yet moved to the patched release described in KB3159623. No public exploit code has been identified and the vendor states it is not aware of malicious exploitation at time of analysis, but the 9.3 CVSS 4.0 rating - along with a more conservative independent assessment that raises attack complexity to High and lowers availability impact - makes prompt patching of any remaining unpatched instance the priority.
Improper JWT signature verification in Dashbit's nimble_zta (0.1.2 up to but not including 0.1.3) lets an unauthenticated remote attacker bypass authentication and impersonate an arbitrary Cloudflare service token in applications using the Cloudflare Zero Trust service-token strategy. Because verify_token/2 pattern-matches the {_, token, _s} tuple returned by JOSE.JWT.verify/2, the boolean signature-verification result is discarded and a forged JWT sent in the cf-access-jwt-assertion header is accepted as authenticated identity; the attacker only needs the expected iss claim plus the seven service-token claims (aud, common_name, exp, iat, iss, sub, type). No public exploit code has been identified at time of analysis, but the flaw is remotely reachable with no authentication or user interaction (assessed CVSS 3.1 base 9.3, scope changed) and is fixed in nimble_zta 0.1.3.
Session token forgery in SigNoz v0.8.0 through v0.142.x allows unauthenticated attackers to impersonate any user, including administrators, when the default JWT tokenizer provider runs without a configured signing secret. The application defaults the JWT HMAC key to an empty string and fails to reject this in Config.Validate(), so tokens are both signed and verified with an empty key; an attacker who knows a target user ID can forge valid access and refresh tokens, and the refresh token can be rotated at /api/v2/sessions/rotate and cannot be revoked. No public exploit identified at time of analysis; deployments that explicitly set a secret or use the opaque provider are not affected, and v0.143.0 eliminates the exposure.
Authentication bypass in OpenStack Zaqar before 22.0.2 allows an unauthenticated remote attacker who knows a target project's UUID to send a request carrying an empty URL-Signature header and defeat both Keystone authentication and pre-signed URL verification, gaining the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. Only deployments using the WSGI transport with an authentication strategy configured are exposed; the websocket transport is explicitly not affected, and escalation to administrative operations such as managing pools and flavors additionally requires an admin_mode deployment in which the attacker asserts an administrative role. The issue is rated CVSS 4.0 base 9.2, while independent assessment scores it CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) with the AC:H component reflecting the prerequisite knowledge of the victim project UUID; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass in PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8 allows unauthenticated remote attackers to reach restricted functionality through an alternate path or channel, yielding high confidentiality, integrity and availability impact on the scanning platform. The CVSS 4.0 base score of 9.2 and CISA SSVC technical impact rating of 'total' reflect complete compromise of the affected management interface, although an undisclosed attack precondition (AT:P) must be satisfied and the product is normally deployed on segmented internal networks rather than being internet-facing. No public exploit identified at time of analysis, and SSVC exploitation is rated 'none', so this is a serious but not currently imminent priority. Authentication requirements are confirmed unauthenticated by the CVSS vector (PR:N, UI:N). Vendor-released patch: 2026.8.
Linux kernel NFS/RDMA servers using svcrdma accept RPC-over-RDMA Write and Reply chunks whose segcount field is zero, because xdr_check_write_chunk() only rejects segcount values above rc_maxpages and xdr_inline_decode(stream, 0) succeeds without advancing the cursor, causing pcl_alloc_write() to link a struct svc_rdma_chunk with ch_segcount == 0 onto the rc_write_pcl or rc_reply_pcl parsed-chunk lists even though RFC 8166 assigns no meaning to a chunk describing no remote buffer. The vulnerable path is reachable only on NFS servers configured with the RDMA transport over InfiniBand, RoCE, or iWARP, so an attacker must already be an RDMA peer able to send Write or Reply chunks to the server, and the independent assessment rates the realistic impact as availability-only (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the 9.1 input score, because an earlier patch in the same series already made pcl_for_each_segment() safe for ch_segcount == 0. No public exploit code and no confirmed active exploitation are identified at time of analysis, and vendor-released patches are available in 6.12.111, 6.18.50, 7.2.4, and mainline 7.3-rc1.
Command injection in Termix 2.4.1 through 2.5.0 lets an authenticated administrator execute arbitrary operating-system commands as the Termix backend process by storing crafted domain and email values via PATCH /users/acme-ssl-settings and then triggering their interpolation into a certbot shell invocation through POST /users/acme-ssl-request. Successful exploitation exposes Termix databases, process secrets, stored credentials, and the backend's network reachability, with both HTTP-webroot and DNS-Cloudflare challenge modes affected. The issue is fixed in 2.5.1; no public exploit code has been identified at time of analysis, and the practical risk is bounded by the requirement for a high-privileged (administrator) account rather than being reachable pre-authentication.
Path traversal in Delta Electronics DIAEnergie before 1.11.00.022 allows unauthenticated remote attackers to manipulate file paths on the host, with the CVSS vector indicating high integrity and availability impact but no confidentiality impact, which is consistent with arbitrary file writing, overwriting, or deletion rather than file disclosure. Exploitation is rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) and requires only network reachability to the DIAEnergie web application - no credentials, user interaction, or non-default configuration are prerequisites. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so current risk is driven by intrinsic severity and exposure rather than observed exploitation in the wild. The practical threat hinges on exposure: DIAEnergie is a niche industrial energy-management platform typically deployed on segmented OT/enterprise networks, so internet-facing or broadly reachable management interfaces carry the highest risk.
Path traversal in the HTTP server built into the Botslab G980H dash camera lets anyone already connected to the camera's own WiFi network retrieve files from its removable storage without authentication or user interaction. Readable content includes recordings, images, diagnostic logs and firmware files, which are exactly the artifacts a web server should never expose. CISA's ICS advisory ICSA-26-267-01 tracks the issue as CWE-22 and scores it 7.1 (High), driven entirely by confidentiality impact; proximity is the limiting factor, since the flaw is reachable only from the adjacent network and cannot be triggered from the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Server-side request forgery in mcp-remote 0.1.32 through 0.1.38 allows an unauthenticated remote attacker who controls or compromises the remote MCP server the victim connects to to make the client fetch attacker-chosen internal or metadata URLs during OAuth discovery. The victim must initiate the connection (UI:R), and the attacker supplies a malicious WWW-Authenticate header whose resource_metadata URL is not validated by the client. No public exploit or KEV activity was identified at time of analysis and EPSS is low at 0.17% (5th percentile); our independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, requiring user interaction and limiting impact to confidentiality, rather than the reported UI:N and integrity impact.
Cleartext transmission of sensitive data by the Botslab G980H dash camera firmware exposes stored recordings, live video, GPS location, images and diagnostic logs to anyone who can observe the device's WiFi traffic, because the camera exchanges this data with its companion mobile app over unencrypted HTTP and RTSP rather than TLS or encrypted RTSP. The exposure is unauthenticated but adjacent-only (CVSS:4.0 AV:A/AC:L/PR:N, scored 7.1; independently assessed as CVSS:3.1 AV:A/AC:H with confidentiality-only impact), so it requires an attacker within wireless range of, or already joined to, the network the G980H uses to talk to its phone app. No public exploit code has been identified at time of analysis and the issue has not been confirmed as actively exploited (not in CISA KEV); practical risk hinges on how easily the WiFi segment can be reached, which is worse if the camera's access point uses a predictable or default password.
Physical access to the Botslab G980H dash camera's UART interface grants an unauthenticated root shell and exposes the device's WiFi password. The root account requires no password, allowing an attacker with hands-on hardware access to obtain full control and recover network credentials. No public exploit code or active exploitation has been identified, and the CVSS 4.0 base score is 7.0 with a physical attack vector.
Hard-coded root credentials in Botslab G980H dash camera firmware allow anyone who can reach the device's UART/serial interface to obtain full root access, because the password is embedded in the firmware and cannot be changed, rotated, or disabled by the user. Exploitation is physically gated: it requires hands-on access to the camera plus a serial connection, and per the assessed vector (CVSS:3.1 AV:P/AC:L/PR:N/UI:N, CVSS:4.0 base 7.0) there is no prior-privilege or user-interaction barrier once that physical connection is made, while remote or network exploitation is not possible. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is limited to attackers with device custody or those who obtain a firmware image, in which case the exposed credential grants complete control of the device (C:H/I:H/A:H).
Command injection in the pairing process of eufy Omni C20 and Omni X10 Pro robot vacuums lets an unauthenticated attacker on an adjacent network or within wireless proximity run arbitrary system commands on the device during pairing. The vendor rates this CRITICAL at CVSS 4.0 9.0 (AV:A/AC:H/AT:P/PR:N/UI:N, all-high impact including subsequent-system impact), and CISA ICS published advisory ICSA-26-267-02; the practical bar is higher than the score suggests because the attacker must be radio/local-adjacent and catch the device inside an active pairing window. No public exploit code was identified at time of analysis, and the flaw is not confirmed actively exploited (not in CISA KEV).
Multi-factor authentication bypass in authentik (goauthentik) allows an attacker who already knows a target user's password to redirect the email authenticator's one-time code to an address they control, complete enrollment of the email factor as the victim, and obtain a session with access to any single sign-on applications behind the account. Only deployments that enroll the email authenticator during an authentication or enrollment flow are affected, and only where the target has not yet enrolled the email factor; other authenticator types are unaffected. Rated 8.9 by the vendor (independent re-assessment scores it slightly lower on availability impact), there is no public exploit identified at time of analysis and no CISA KEV listing, but the precondition of prior credential knowledge makes this a high-value account-takeover primitive for attackers who phish or reuse passwords. Fixed in 2026.2.7, 2026.5.7, and 2026.8.2.
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitrary operating system commands by exploiting a path traversal flaw (CWE-22). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a High severity score of 8.8, reflecting full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and a vendor patch is available.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements that are passed into an OS command, allowing a remote attacker holding any low-privilege platform account to execute arbitrary operating-system commands on the DataStage host with the privileges of the vulnerable service. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exposure is gated by authentication: there is no anonymous internet-facing path, but multi-tenant deployments, shared service accounts, or any compromised low-privileged credential are sufficient to reach full command execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, while a vendor patch is available.
Authenticated command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker with valid low-privileged credentials to execute arbitrary operating-system commands, potentially compromising confidentiality, integrity, and availability (CVSS 8.8). Exploitation requires network reachability to the DataStage/CP4D interface and the ability to supply input that is mapped into an unneutralized environment variable (CWE-78); no user interaction is needed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with total technical impact, so this is a genuine high-severity finding but not an emergency.
Command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only a low-privilege account to execute arbitrary OS commands on the host, with high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid credentials and the ability to reach a code path that constructs an operating system command from user-supplied input without neutralizing shell special elements; no user interaction is needed, and the deployment context - an internal enterprise ETL service rather than an internet-facing endpoint - plus the narrow affected version materially constrain real-world exposure. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); a vendor patch is available per IBM's advisory.
Memory corruption in the Botslab G980H dash camera firmware allows an authenticated attacker on the same local network segment to submit crafted command data that writes past the bounds of an allocated buffer, potentially corrupting authentication state or terminating the affected process so the device restarts. The result is a temporary denial of service - the device becomes briefly unavailable while it reboots - with no demonstrated path to code execution, privilege escalation, or data disclosure (CVSS 4.0 base 6.9; availability-only impact, adjacent vector, low privileges required, no user interaction). No public exploit code has been identified at time of analysis, and CISA has not listed this CVE in the KEV catalog; the issue is reported by ICS-CERT in advisory ICSA-26-267-01.
Unauthenticated Bluetooth Low Energy access on the Botslab G980H dash camera lets any attacker within BLE radio range read sensitive on-device data - device identifiers, firmware details, and protected WiFi credentials - because the firmware exposes GATT characteristics without requiring authenticated pairing or client binding. The flaw is a missing-authentication condition (CWE-306) that exists in the default device state, so no credentials, user interaction, or special tooling are required; the practical constraint is physical proximity, as there is no internet-reachable attack path. No public exploit code has been identified at time of analysis, and CISA published an ICS advisory (ICSA-26-267-01) covering the product. Because impact is limited to confidentiality (no integrity or availability effect), this is best characterized as a real but physically constrained information-disclosure issue rather than a mass-exploitable network flaw.
Privilege escalation in the authentik identity provider allows an account holding delegated group, group-membership, or user management rights to elevate itself to superuser by joining a group whose ancestor groups grant superuser status, or by assigning an existing role to a group without holding the change_role permission. Deployments running authentik before 2026.2.7, before 2026.5.7 on the 2026.5 line, or before 2026.8.2 on the 2026.8 line are affected, but exploitation is confined to installations that delegate those management capabilities to accounts that are not full administrators - single-administrator or non-delegated setups are unaffected. The flaw rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires the attacker to hold an authenticated delegated account, and no public exploit code has been identified at time of analysis; vendor patches are available and the fix set is documented in advisory GHSA-h6c5-mpvq-j4jc.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) run arbitrary operating system commands on the affected platform, yielding high confidentiality, integrity, and availability impact for an overall CVSS base score of 8.8. Exploitation requires a valid CP4D session and access to the DataStage functionality that forwards attacker-controlled input into a shell command without sanitization; no public exploit identified at time of analysis, and IBM has published a vendor fix. Only the 5.4.0.0 build is explicitly named as affected, so patched builds referenced in IBM's advisory remove the exposure.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a low-privileged user with network access to the service reach an unsafe deserialization sink and execute arbitrary code in the context of the affected component. The issue is CWE-502 (deserialization of untrusted data) rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so a successful attack yields high confidentiality, integrity and availability impact with no user interaction required. Exploitation requires previously obtained valid CP4D/DataStage credentials (PR:L) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none and the attack as not automatable, though the technical impact is rated total.
Catalyst::Seal before 0.03 memoises how a request path resolved using the path alone as the cache key, so an unauthenticated GET to a path whose action is declared POST-only poisons that entry and permanently disables the route for every later request in the same Perl process, including the legitimate POST. Where a POST-only action sits below a shallower action on the same path, a priming GET memoises the shallow route and a subsequent POST is dispatched there, skipping the deeper controller's auto() authorization guard. Exploitation requires a Catalyst application that has installed this non-default module; no public exploit has been identified at time of analysis and EPSS is low at 0.35% (26th percentile), while our independent assessment revises the impact down from the vendor-reported C:H/I:H/A:H to C:L/I:L/A:L (unauth., AV:N/AC:L/PR:N/UI:N/S:U), reflecting functional denial plus a possibility of an authorization check not running rather than a full compromise.
Heap over-read in DCMTK through 3.7.0 allows unauthenticated remote attackers to crash applications or leak adjacent heap memory by supplying a crafted DICOM instance whose declared NumberOfFrames exceeds the actual PixelData buffer length. The flaw resides in the ConcatenationLoader module (dcmfg) and is triggered when loading multi-frame DICOM concatenations; exploitation requires an ingestion path that processes untrusted instances (e.g., a DICOM network storage service), as offline viewers typically require a user to open the file. No public exploit code is identified at time of analysis, and a vendor patch is available via upstream commits.
Out-of-bounds reads in the Linux kernel's Greybus audio topology parser allow a malicious or compromised Greybus module to leak kernel memory and crash the system. The module declares a small topology blob size but supplies large le32 section sizes (size_dais, size_controls, size_widgets) that are added to build the control, widget and route section offsets without ever being checked against the fetched blob, so gbaudio_tplg_parse_data() walks past the allocation. Exploitation requires the kernel to be built with Greybus audio support and a rogue module attached to the UniPro/Greybus interconnect - a rare hardware configuration - and no public exploit code has been identified at time of analysis. Note that while the supplied NVD-style vector rates this 8.8 with C:H/I:H/A:H under AV:A, our assessment is that the weakness is fundamentally a read-side bug requiring physical/hardware access (AV:P, C:H/I:N/A:H), and the 8.8 score overstates both the access path and the integrity impact.
Remote code execution in mcp-remote 0.1.16 through 0.1.38 allows an attacker who controls or compromises a remote MCP server to run arbitrary code on a connected client by supplying a malicious OAuth authorization URL that the tool passes to open() without validation. Exploitation requires the victim to initiate a connection to that malicious server (user interaction, UI:R) and no victim-side authentication is required (PR:N); users who connect only to trusted first-party MCP servers are not affected. The EPSS score is low (0.29%, 19th percentile), no public exploit identified at time of analysis, and no CISA KEV confirmation of active exploitation.
Out-of-bounds access to native Wi-Fi header fields in the Linux kernel's ath11k driver can corrupt kernel stack memory when a received frame's length exceeds the maximum native Wi-Fi header size in the DP_RX_DECAP_TYPE_NATIVE_WIFI decapsulation path (ath11k_dp_rx_h_undecap_nwifi). Unauthenticated adjacent attackers within radio range (AV:A, PR:N, UI:N) against systems running the ath11k driver on supported Qualcomm Wi-Fi hardware - tested on WCN6855 hw2.1 PCI with WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 firmware - can trigger a malformed over-the-air frame that leads to kernel stack corruption and a crash; no public exploit has been identified at time of analysis. Independent assessment rates this CVSS 3.1 AV:A/AC:H/PR:N/UI:N/C:L/I:L/A:H, meaning the vendor/NVD score of 8.8 overstates real-world risk: the trigger path must be active, the attacker must be radio-adjacent, and the confirmed outcome is memory corruption/crash rather than demonstrated code execution.
Error recovery in the Linux kernel's nvme-fc (NVMe-over-Fibre-Channel) transport can abort in-flight requests against an io tagset that has not yet been allocated, producing a lockdep 'trying to register non-static key' warning and faulting the error-recovery path when a newly created controller in CONNECTING state loses connectivity. Affected systems are those running kernels before 6.12.111 or 6.18.53 (the fix is also merged for the 7.2 line), specifically hosts with NVMe-over-FC hardware such as an lpfc HBA; the trigger is an admin request timeout during controller connect caused by FC link loss, so it is a local availability/robustness defect rather than an attacker-supplied input, with no public exploit identified at time of analysis. The independent assessment rates this AV:L/AC:H/PR:L with availability-only impact and high attack complexity and, notably, the published CVSS 8.8 network-adjacent score is not supported by that analysis - the practical exposure is confined to FC-attached hosts whose connect path already failed.
Out-of-bounds read in the Linux kernel's cfg80211 wireless stack allows an attacker within 802.11 radio range to deliver a crafted, too-short association-response management frame - including the S1G variant with its distinct information-element offsets - which the client parses during the association window before frame length is validated, resulting in reads beyond the received buffer that can crash the kernel (availability impact) and expose limited adjacent memory. No authentication is required (CVSS PR:N) and no user interaction is needed, but exploitation is constrained to over-the-air proximity to a client that is actively associating on a vulnerable pre-patch kernel; a target with WiFi disabled or not associating is unaffected, there is no Internet reachability, and no public exploit code has been identified at time of analysis. Vendor patches are available for the affected stable and mainline branches.
Out-of-bounds array indexing in the Linux kernel's iwlwifi mvm wireless driver can crash the kernel and read a small amount of adjacent memory when a compromised or malicious Intel WiFi adapter firmware sends a BA_WINDOW_STATUS_NOTIFICATION containing an out-of-range station ID. Systems running affected kernels before 6.12.111 or before 6.18.53 with an active Intel WiFi device are in scope, but the attacker must already control the firmware-side notification, so the NVD CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N) substantially overstates real-world risk. No public exploit code or confirmed active exploitation was identified at time of analysis.
Out-of-bounds reads and subsequent kernel instability in the Linux kernel's iwlwifi MVM driver (Intel WiFi) can be triggered when the WiFi firmware returns a malformed TX_CMD response whose frame_count does not match the actual response buffer layout. The affected code parses status entries by walking frame_count and then reads a trailing SCD SSN field without first validating that the buffer is long enough, so a malicious, compromised, or substituted device firmware can push the parser past the end of the payload, yielding limited information disclosure and, more likely, a kernel fault that takes down the driver or system. Systems running any Linux kernel built from the affected ranges (fixed in 6.12.111, 6.18.53, and 7.2) with an Intel WiFi adapter are exposed; there is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, and the practical attack surface is a firmware-to-host trust boundary rather than over-the-air radio traffic. Note that the supplied CVSS of 8.8 (AV:A/AC:L) overstates real-world risk; an independent assessment scores this AV:L/AC:H with confidentiality Low and availability High.
Out-of-bounds tid_data array access in the Linux kernel's iwlwifi mvm driver (CVE-2026-93790) is a theoretical flaw that writes the lq_color value into an unrelated tid_data slot, but it is not practically triggerable because multi-TID blockack is not in use, meaning the TFD loop counter 'i' is always 0 and the write remains in-bounds on unpatched systems. The affected component is the Intel iwlwifi mvm Wi-Fi driver in Linux kernel versions prior to 6.18.53, 6.12.111, and 7.2. An attacker within Wi-Fi radio range (adjacent, unauthenticated per the assessed CVSS vector) would need a contrived multi-TID blockack scenario to cause minor rate-control state corruption; no public exploit code exists and there is no evidence of active exploitation, so real-world risk is low.
SQL injection in Delta Electronics DIAEnergie before version 1.11.00.022 allows an attacker holding a valid low-privileged account to read from and write to the platform's backend database, putting the confidentiality, integrity, and availability of its operational data at risk. The flaw is network reachable (AV:N), requires only a low-privileged session (PR:L), and needs no user interaction; it is not confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis. Delta released the fix in advisory PCSA-2026-00014 alongside a batch of related DIAEnergie flaws, including an authentication bypass (CVE-2026-78308) that could supply the very credentials this SQL injection depends on.
SQL injection in Delta Electronics DIAEnergie versions before 1.11.00.022 lets a remote attacker with any valid low-privileged account (CVSS PR:L) execute arbitrary SQL against the underlying database, resulting in full loss of confidentiality, integrity, and availability (CVE-2026-78309, CWE-89, base score 8.8). The flaw is network-reachable with low attack complexity and no user interaction, so it can be triggered directly over the DIAEnergie web interface, though valid credentials are required and the specific vulnerable parameter or endpoint has not been disclosed in the available data. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV), so the immediate risk is highest for internet- or IT-network-exposed deployments where low-privileged accounts are broadly issued. The advisory from Delta covers this CVE alongside five siblings (CVE-2026-78308 through CVE-2026-78313).
The Linux kernel's Thunderbolt XDomain (host-to-host / peer) service handling carries a lifetime defect: the service ID is released in tb_service_release() while the ID array that backs it is owned by the parent XDomain, so a service can outlive the XDomain reference it depends on and teardown of a Thunderbolt connection can access a freed/absent parent structure. The assessed practical outcome is a kernel crash (denial of service) with only limited integrity impact, and reaching the bug requires a system with the Thunderbolt driver active plus a physically attached Thunderbolt device or peer host to establish the XDomain connection - the supplied CVSS 8.8 vector (AV:A/AC:L, C:H/I:H/A:H) is significantly overstated versus the assessed physical-access, high-complexity vector (AV:P/AC:H, C:N/I:L/A:H). Vendor patches are available for the stable trees and mainline (5.10.266, 5.15.217, 6.12.111, 6.18.53, and 7.2), and no public exploit code was identified at time of analysis.
Type confusion in the AWS pgcollection PostgreSQL extension (versions 2.0.0 through 2.1.1) lets an authenticated remote database user execute arbitrary code as the postgres operating system user by submitting crafted SQL that triggers mismatched type metadata during collection value retrieval and array conversion. The flaw carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H), reflecting a network-reachable, low-complexity attack that requires only a valid low-privileged database role but yields full confidentiality, integrity and availability impact. AWS has released pgcollection 2.1.2 as the fix; no public exploit code has been identified at time of analysis, and exploitation is constrained to databases where the non-default extension is actually installed and where an attacker can execute the affected SQL functions.