Redirect-policy bypass in Axios 1.17.0 up to (but not including) 1.20.0 causes the fetch adapter to follow HTTP 3xx redirects even when the application explicitly sets maxRedirects: 0, so a redirect-blocking control that developers rely on as a security boundary is silently ignored. The flaw is a confused-deputy issue (CWE-441): an attacker positioned to control a redirect response from a server the application calls can push the request to internal responses or state-changing internal endpoints that should have been unreachable. Exploitation requires three simultaneous conditions - use of the fetch adapter (not the default http/xhr adapters), an explicit maxRedirects: 0 setting used as a security control, and an attacker-influenced redirect target - and per the independent assessment it is unauthenticated (CVSS PR:N) with only a single additional precondition (AT:P), yielding no direct impact on the axios host (VC/VI/VA:N) but high confidentiality and integrity impact on the subsequent internal systems reached (SC:H/SI:H). There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Privilege destruction in InvoicePlane 1.7.2 allows an authenticated secondary administrator to demote the primary administrator account (user_id = 1) to a read-only Guest role by exploiting a missing object-level authorization check in the Users::form() endpoint. This locks the legitimate owner out of the instance. The vulnerability requires an attacker who already holds a secondary admin account (user_type = 1) and a deployment with more than one administrator; no public exploit code or active exploitation has been identified at time of analysis, and no vendor patch is currently available.
Use-after-free in GCC's libstdc++ handling of erase_if on a binary-heap priority queue (std::priority_queue) allows unauthenticated remote attackers to crash applications, and potentially corrupt memory, when the application invokes that operation with attacker-influenced contents that force a storage reallocation; the assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H (7.0 High) reflects high attack complexity and low confidentiality/integrity impact against high availability impact. Exploitation is conditional rather than self-contained: the flaw is a library primitive, so reachability depends entirely on whether the consuming application exposes the erase_if code path to external input, and the demonstrated outcome is a crash with memory corruption described only as 'potential.' No public exploit identified at time of analysis and the issue is not in CISA KEV; this is a genuine but conditional memory-safety flaw whose real-world priority is moderate, not urgent.
An unauthenticated attacker (CVSS PR:N) who obtains physical access to the on-chip debug and test interface of the SMCU on Dell 17G BOSS-N1 controllers can bypass the intended access controls and gain unauthorized access to the controller before firmware version 2.2.13.2038 is applied. Exploitation is constrained by the need for direct hardware contact - typically an opened chassis and a debug connection - plus high attack complexity and a required interaction step (AV:P/AC:H/UI:R), so the practical risk is LOW despite the HIGH 7.0 base score with scope change and full confidentiality, integrity, and availability impact on the component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); realistic exposure is limited to insider, supply-chain, in-transit, decommissioned/RMA, or unattended data-center scenarios.