An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers execute arbitrary shell commands on the router by supplying a crafted ntp_ip value to /set_ntp_server_ip.cgi. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) confirms no privileges or user interaction are needed, and the only real precondition is network reachability to the device's web management interface, so risk is highest where that interface is exposed to the WAN. Publicly available exploit code exists (linked from the VulDB disclosure and hosted on GitHub), but there is no CISA KEV entry, so active exploitation is not confirmed; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Missing authorization in Netcore NBR100V2 firmware 1.3.240614.030928 allows remote unauthenticated attackers to modify device configuration via the uci.apply function, as the /usr/share/rpcd/acl.d/unauthenticated.json ACL incorrectly grants this function to unauthenticated callers. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, so no vendor-released patch is identified at time of analysis. The primary exploitation barrier is network reachability to the router's rpcd/ubus management interface, which is typically LAN-bound unless exposed to the WAN.
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and abuse its process_request function to write arbitrary files, leading to full device compromise with high confidentiality, integrity, and availability impact (CVSS 4.0 score 9.3, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects firmware version 1.4.5102, and publicly available exploit code exists - a GitHub proof-of-concept demonstrating unauthenticated arbitrary file write against the NR289-GE V1.4.5102 web interface. No CISA KEV listing was provided; the vendor was contacted early but did not respond, and no vendor patch has been identified at time of analysis.
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary commands on the router via the 'mac' parameter of the /location_time.cgi Location Time Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no patch is available at this time. The primary limiting factor is exposure: the web management interface is typically LAN-facing by default, so internet-wide exploitation depends on remote management being exposed to untrusted networks.
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can reach the device's /ap_ip.cgi CGI handler execute arbitrary shell commands on the underlying operating system, with CVSS v4.0 scored 9.3 and all three impact metrics (confidentiality, integrity, availability) rated High. No authentication or user interaction is required - stated by the CVSS vector PR:N/UI:N and confirmed by our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - so the only prerequisite is network reachability of the router's web service, which is LAN-bound by default but internet-facing whenever remote administration is enabled. Publicly available exploit code exists (a detailed proof-of-concept for the ap_ip command injection is published in a public GitHub repository), and the vendor was contacted but did not respond, so at the time of analysis there is no vendor fix and the practical exposure is limited only by how widely each deployment exposes the management interface.
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated remote attackers corrupt stack memory by sending a crafted message to the copy_msg_element function, with high impact on confidentiality, integrity, and availability. The flaw is remotely reachable with no privileges or user interaction required (CVSS:4.0 base 9.3; independent assessment of 3.1/AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H), and publicly available exploit code exists, so any deployment where the service is reachable - typically LAN-adjacent, or WAN-exposed if the device forwards the service externally - is at risk. Exploitation is not confirmed as active (no CISA KEV entry), and the vendor was contacted early but never responded, so no official patch has been identified.
Unauthenticated OS command injection in the Netcore NBR200V2 router's Web Management Interface (firmware 1.3.241127.071246) allows remote attackers to execute arbitrary operating-system commands on the device by sending a crafted QUERY_STRING to /www/cgi-bin/network_tools, where the eval handler passes the attacker-controlled value into a shell command without sanitization. The CVSS 4.0 base score is 9.3 with full confidentiality, integrity and availability impact, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the attack is network-reachable with no authentication and no user interaction. Publicly available exploit code exists, including a published proof-of-concept write-up on GitHub, but there is no confirmed active exploitation in CISA KEV; the vendor was contacted early about the disclosure and did not respond, so no vendor patch is available.
Archive extraction in the Node.js decompress package allows a crafted archive containing chained symlink entries to resolve file writes outside the intended output directory, because the default decompress(input, output) API relies on lexical path containment checks that the kernel's symlink resolution can bypass. This affects @xhmikosr/decompress before 10.2.2 and before 11.1.4, and the separately maintained but unmaintained kevva/decompress package through 4.2.1, which remains unpatched. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, 9.1) indicates unauthenticated remote triggering with high confidentiality and integrity impact; writing outside output can overwrite startup scripts or configuration and escalate to remote code execution, and the flaw is a bypass of the incomplete hardening previously applied for CVE-2026-53486. Exploitation requires the consuming application to extract an attacker-influenced archive on a non-Windows platform (Windows emulates symlinks via hardlinks and does not follow the affected path), and no public exploit code was identified at time of analysis, though the upstream fix ships a regression test that documents the escape technique.
Forged HS256 JSON Web Tokens can be accepted as authentic by PyJWT (pip package PyJWT) versions 2.13.0 through 2.13.x when an application verifies tokens through the PyJWK or PyJWKSet path and its trusted JWK Set already contains a symmetric oct entry with an empty key value ({"kty":"oct","k":""}), an unusual precondition typically caused by a missing Base64URL configuration or secret-manager value. Because the PyJWK verification path passes the decoded zero-length key straight to the HMAC check instead of running it through HMACAlgorithm.prepare_key, unauthenticated remote attackers (CVSS PR:N) who know this pre-existing misconfiguration can independently compute HMAC-SHA256(b"", signing_input) and mint valid tokens carrying arbitrary authenticated claims, giving high confidentiality and integrity impact. Public proof-of-concept exploit code exists, but the issue is not in CISA KEV, EPSS is low at 0.18% (6th percentile), and the independent assessment rates attack complexity as High rather than Low, so the headline CVSS 9.1 overstates real-world urgency; the vendor-released patch is version 2.14.0 (commit f91ed44dd65baaf457f4b3353ed35e98a753934c).
Arbitrary file write as root in Canonical LXD 4.0 and later (before 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux lets an authenticated client with permission to create instances or custom storage volumes in a project - or a malicious migration source server - plant a symlink inside a transferred volume and then write through it to any path on the target host, resulting in full host compromise. Exploitation requires triggering a volume migration receive and supplying a crafted rsync or btrfs send stream that plants a symlink at a name such as rootfs or root.img; the flaw is an improper link resolution issue (CWE-59) in the receive path that does not confine link targets to the volume. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, though the independent assessment rates this a genuine high-priority vulnerability rather than a CVSS-inflated one given the authenticated, low-privilege path to root.
Path traversal in Canonical LXD's Btrfs storage driver allows an authenticated user with instance-creation privileges to escape the intended backup import target and delete or replace arbitrary files and directories on the host as root, by supplying a crafted subvolumes[].path value in backup/optimized_header.yaml during a btrfs 'optimized' backup import. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) reflects high confidentiality, integrity and availability impact with a scope change because the traversed write lands outside the LXD daemon's own container boundary; exploitation requires valid low-privilege API credentials and a Btrfs-backed host, not anonymous access. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV), but the low attack complexity and root-level file-system effect make it a genuine high-priority fix rather than a CVSS-inflated score.
Privilege escalation to remote code execution in Apache Karaf before 4.4.12 lets any authenticated shell session - including one holding only the viewer role - execute every jdbc:* and jms:* command, because the command guard (SecuredSessionFactoryImpl) treats commands with no matching ACL rule as permitted and the jdbc/jms ACL configuration files are never shipped. An attacker can use jdbc:ds-create to store a fully controlled JDBC URL into a pax-jdbc-config factory Configuration that is reactively turned into a live DataSource; drivers that act on URL parameters at connect time (for example H2 with INIT=RUNSCRIPT) then execute attacker code, bypassing the admin-role gate that protects shell:exec. No public exploit code identified at time of analysis, EPSS is low at 0.19% (8th percentile), and no CISA KEV listing applies; vendor-released patch: 4.4.12.
Authenticated path traversal in Apache Karaf before 4.4.12 allows a principal holding the shipped 'manager' role to write attacker-controlled content to arbitrary files writable by the Karaf process, because ConfigRepositoryImpl.update() and createFactoryConfiguration() build the target configuration filename from caller-supplied input without confining the result to ${karaf.etc}. Under Karaf's default command/JMX ACL (org.apache.karaf.command.acl.conf.cfg maps 'update = manager'), this lets a manager-role user overwrite files the same ACL reserves to 'admin' - such as etc/users.properties, etc/*.acl.*.cfg, and etc/org.apache.karaf.management.cfg - and thereby grant themselves the admin role or take over the container. The advisory does not indicate active exploitation, and no public exploit code has been identified at time of analysis; EPSS is 0.17% (6th percentile), indicating low predicted exploitation, while published scoring (CVSS 9.8, PR:N) is more severe than this assessment, which requires an authenticated manager-role principal (PR:L) on a deployment that exposes Karaf management and grants manager to non-admins.
Signature verification bypass in Authlib 1.7.2 and earlier allows unauthenticated remote attackers to have crafted JWS JSON Serialization payloads accepted as valid, because JsonWebSignature.deserialize_json() returns the payload without checking for a signature or requiring a cryptographic key. The flaw affects applications that use that method to process incoming tokens and then trust the returned payload for authentication, authorization, or integrity decisions; applications using only compact JWS or independently verifying signatures are not exposed. No public exploit code has been identified at time of analysis, and EPSS is low at 0.12% (2nd percentile), but the issue is remotely exploitable with no authentication or user interaction and is assessed as high severity.
Default or unchanged credentials in Logsign SIEM 6.4.101 through 6.4.116 allow remote, unauthenticated attackers to gain full control of an exposed instance simply by trying vendor-supplied or commonly used username and password pairs. The flaw is rated CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because a successful login yields complete confidentiality, integrity and availability impact on a platform that aggregates security telemetry and often holds integration credentials for other systems. Exploitation requires network reachability to the Logsign SIEM authentication/management interface and that the deployment still uses default or unchanged common credentials; no prior authentication is needed. At the time of analysis there is no public exploit code or confirmed CISA KEV active exploitation, and no EPSS score was supplied, but the low attack complexity and the value of the target make internet-exposed instances a high-priority risk. The issue was reported by TR-CERT and is tracked against CWE-1392.
Stored cross-site scripting in the SUSE Rancher UI allows unauthenticated remote attackers to inject malicious script through updates to public UI settings, which then executes in the browser of any user-including administrators-who later views the affected interface. Affected versions are SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18. Vendor CVSS 3.1 rates this 9.6, while our independent assessment lowers the availability impact to low; no public exploit identified at time of analysis, and exploitation requires network reachability to the Rancher management endpoint plus a victim loading the UI.
Unauthenticated remote code execution affects all versions of SailPoint IdentityIQ through improper input validation in its web service API. Attackers on an adjacent network segment can submit crafted content to the API to execute arbitrary code on the server without authentication or user interaction. The vendor rates this as critical (CVSS 9.6); no public exploit code has been identified as of this analysis.
Path traversal in the btrfs storage driver of Canonical LXD 4.0.2 and later allows an authenticated client that holds project-scoped permission to create instances to delete arbitrary files on the host as root by supplying a crafted subvolume path containing ../ sequences, and on hosts whose root filesystem is itself btrfs the same primitive escalates to placing attacker-controlled content at arbitrary host paths for full host compromise. The issue is rated CVSS v3.1 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H), reflecting a scope-changing breakout from a restricted tenant role into the host root context rather than a CVSS-inflated score, since a legitimate but limited project credential is the only prerequisite. No CISA KEV listing and no public exploit code were identified at time of analysis; vendor fixes are available in LXD 4.0.14, 5.0.10, 5.21.8 and 6.10.
Arbitrary code execution in Google Cloud Application Integration (versions prior to 2026-06-28) allows an authenticated user holding only standard permissions to run code on shared, multi-tenant production servers by crafting a JavaScript Task script that bypasses the platform's built-in parameter guards and reaches an unsafe deserialization path. The CVSS 4.0 base score is 9.4, and because the flaw breaches the tenant trust boundary the subsequent-system metrics are also High, meaning other customers on the same shared infrastructure are exposed rather than just the attacker's own tenant. Authentication is required (CVSS vector PR:L), there is no public exploit identified at time of analysis, and Google remediated the issue entirely server-side on 28 June 2026, so no customer action is needed and the vulnerability is no longer exploitable against the managed service.
Authenticated Google Cloud users holding permission to configure Application Integration tasks could abuse an incorrectly authorized, internal-only task type to trigger arbitrary internal RPCs that executed inside Google's production network under a privileged Google identity. The flaw (CWE-863) affected Application Integration on Google Cloud Platform in all versions prior to the 17 June 2026 fix, and the vendor's CVSS 4.0 vector of 9.4 reflects a genuine privilege-escalation and scope-crossing condition (SC/SI/SA:H) rather than simple data exposure. Google remediated the issue server-side on 17 June 2026 and states no customer action is required, meaning no current deployment remains exploitable; no public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Unauthenticated time-based blind SQL injection in the Dayforce Payroll password-recovery (forgot-password) function lets remote attackers push arbitrary SQL into a query parameter that is concatenated into a SQL predicate, potentially exposing or altering backend payroll data. The published CVSS 4.0 score is 9.3 with PR:N and no user interaction, and the independent assessment agrees on high confidentiality and integrity impact with no availability impact, but exploitation is time-based blind, so it demands many timed requests and is slower and more detectable than direct exfiltration. The issue is confirmed only in version R2026.2.0 after unsuccessful vendor contact attempts; no public exploit code or confirmed active exploitation was identified at time of analysis, and because much of Dayforce is delivered as vendor-hosted SaaS the set of independently exploitable targets is narrower than the raw score implies.
Unauthenticated SQL injection in the OrdaSoft Book Library (Free) extension for Joomla, affecting all versions below 6.4.6, allows remote attackers to inject arbitrary SQL into an ORDER BY clause via the field and direction request parameters handled by the books() function in site/booklibrary.php. Because the injection lands in an unquoted ORDER BY position, the extension's keyword-blacklist filter (protectInjectionWithoutQuote()) can be defeated with a trailing decoy comment such as '-- xselect' that makes the filter merely quote the value instead of rejecting it, and exploitation requires only a prior request to prime session-stored sort defaults before the vulnerable code path is reached. Both the vendor's CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, high C/I/A) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate a fully unauthenticated, low-complexity, network-reachable flaw with high confidentiality, integrity, and availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Real Estate Manager (Free) extension for Joomla before 6.7.9 allows remote attackers to inject arbitrary SQL through the order_field parameter, which is concatenated unquoted into the ORDER BY clause of three public frontend property-listing queries (category browsing, search results, and full listing). Because the injection point is exposed on pre-authentication pages with no login, user interaction, or non-default configuration required, any reachable installation is at risk; the assessed impact is high confidentiality loss (blind extraction of database contents), while the ORDER BY sink constrains the attacker to data-read techniques rather than direct modification. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the only reference supplied is the vendor site, so patch status should be verified directly with OrdaSoft.
Unauthenticated SQL injection in the Vehicle Manager (Free) extension for Joomla versions prior to 6.5.8 allows remote attackers to inject SQL code via the order_field and order_direction parameters at three frontend entry points (category listing, search, and all-vehicles listing). Because the injection point is an unquoted ORDER BY clause, exploitation is constrained to blind/inferential techniques, but it can still lead to high confidentiality impact (e.g., extraction of sensitive database contents) with limited integrity and availability impact. No public exploit code has been identified, and the vulnerability requires no authentication or non-default configuration, making any public-facing installation a potential target; however, the overall real-world priority is moderate due to the product's footprint.
Unauthenticated OS command injection in the WatchGuard AP internal API service lets any host that can reach the access point's management-facing API execute arbitrary shell commands on the device's underlying operating system, yielding full compromise of confidentiality, integrity, and availability of the AP itself. Per the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials or user interaction are required, but exploitation is gated by network reachability - an attacker must be able to route to the internal API endpoint, which in practice points to the same network or management segment as the AP rather than arbitrary internet-wide exposure. No public exploit code has been identified and there is no CISA KEV entry at time of analysis, though the 9.3 severity and the absence of authentication make this a genuine high-priority issue where management-plane exposure exists; no EPSS score was included in the available data. A vendor PSIRT advisory is published at https://psirt.watchguard.com/CVE-2026-86102.
Authentication bypass in the internal API service of WatchGuard Access Points lets unauthenticated attackers who can reach the AP's management or internal API network obtain a valid API session. The issue is rated CVSS 9.3 by the vendor and assessed as high priority, with high confidentiality, integrity, and availability impact on the AP; exploitation requires network adjacency or Wi-Fi range rather than guaranteed internet exposure. No public exploit or confirmed active exploitation was identified at time of analysis.
Remote, unauthenticated attackers can retrieve arbitrary local files from Dayforce Payroll by calling its file-download functionality with an absolute path or directory-traversal sequence in the file path parameter, with the server returning the file contents directly in the response. The issue is scored CVSS 4.0 9.2 (vendor/NVD) - network-reachable, low complexity, no privileges or user interaction required, high confidentiality impact, and a scope change to subsequent systems - making payroll data, PII, credentials and configuration secrets the realistic target set. Because vendor contact attempts were unsuccessful, only version R2026.2.0 is confirmed affected and the full version range remains unknown; no public exploit code has been identified at time of analysis.
Missing rate limiting on the authentication API of Nginx Proxy Manager through 2.16.0 allows unauthenticated remote attackers to submit unlimited password guesses to POST /api/tokens and then unlimited TOTP guesses to POST /api/tokens/2fa, ultimately obtaining a valid session and full administrative control of the instance. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV, but the weakness is directly reachable by anyone who can talk to the admin interface, which is commonly internet-exposed on self-hosted deployments. Successful compromise is probabilistic rather than certain: it depends on the target account using a weak or previously-breached password and, where 2FA is enabled, on additionally guessing a rotating six-digit code, which is why our assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is more conservative than the published 9.1 CVSS 4.0 score.
Unauthenticated access to Bluehood's /api/* endpoints in releases before 0.7.1 lets any network attacker who can reach the dashboard HTTP port read Bluetooth tracking data and rewrite application state - the heartbeat URL, prune retention, device groups and per-device notes - whenever the operator has enabled the opt-in auth_enabled setting. The root cause is a missing authorization check: only the HTML page handlers called the session-validation routine, while the settings, devices, groups and /api/device/{mac}/notes handlers performed no check at all, allowing requests carrying no session cookie to succeed (CWE-306, CVSS 3.1 9.1 with PR:N/AC:L). Real-world urgency is tempered by the niche deployment and the fact that the dashboard must be reachable over the network rather than bound to localhost; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Signature forgery in PyJWT before 2.14.0 allows an attacker who knows a target's asymmetric public key to forge HMAC-authenticated JWTs when the application mixes HMAC and asymmetric algorithms and passes asymmetric public-key PEM bytes into HMAC verification. The flaw is in is_pem_format in jwt/utils.py, which fails to recognize all PEM formatting variants accepted by the cryptography loader, causing HMACAlgorithm.prepare_key to treat a mutated public-key PEM as an HMAC secret. Exploitation requires a specific non-default deployment pattern-mixed algorithm verification with raw PEM key bytes-and the assessed CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N; no public exploit identified at time of analysis, and no CISA KEV status was provided.
JWKS trust-boundary bypass in PyJWT's PyJWKClient allows a configured trusted JWKS endpoint that returns an HTTP 3xx redirect to steer the client to an attacker-chosen host, which is then consumed as authoritative key material; the same mechanism can forward caller-supplied request headers such as Authorization to that destination. Only PyJWT 2.13.0 and earlier are affected (fixed in 2.14.0), and exploitation is not unconditional: it requires the application to actually use PyJWKClient for remote JWKS fetching, attacker influence over the trusted endpoint's redirect response, and - for credential leakage - caller-supplied headers passed into the client, or - for forged-JWT acceptance - a mixed-configuration deployment. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.16% (4th percentile), and CISA SSVC rates Exploitation as 'none' and Automatable as 'no', so the practical risk sits well below the headline 9.1 base score.
Improper authorization in Apache SkyWalking BanyanDB 0.11.0 allows a user holding only a readonly Canopy role to push non-read requests through the Canopy monitoring proxy to a configured monitoring target, effectively escalating a read-only account into a write-capable path. The flaw is reachable only under a non-default deployment in which the experimental Canopy proof-of-concept role system and the monitoring-proxy feature are both enabled and a monitoring target is configured, and the attacker must already hold a valid low-privilege Canopy credential; the headline CVSS of 9.1 assumes PR:N/AC:L, which conflicts with this assessed PR:L/AC:H profile. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS is low at 0.15% (4th percentile), reflecting the narrow configuration prerequisites. Users should upgrade to 0.11.1, which fixes the issue.