Unauthenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets any attacker who can reach the service execute arbitrary operating system commands on the underlying host. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires no credentials, no user interaction, and no non-default configuration, so a default Langflow deployment exposed beyond localhost is directly exploitable. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); IBM has published a vendor advisory with a fix, and practical risk is concentrated in self-hosted developer instances that are bound to reachable interfaces rather than being restricted to localhost or placed behind authentication and firewalling.
Unauthenticated remote attackers with IP reachability to an affected Cisco NX-OS device can achieve arbitrary code execution with root privileges - or force a process crash and device reload - by sending crafted packets to the VXLAN Operation, Administration, and Maintenance (NGOAM) feature. The flaw is a stack-based buffer overflow (CWE-121) triggered by insufficient validation of IP traffic, and it is fully unauthenticated and requires no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N), yielding a 9.8 base score. Exploitation is gated by configuration: NGOAM is not part of a default NX-OS base image and must be explicitly enabled, so only VXLAN deployments that have turned the feature on and that expose an IP interface to the attacker are exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, but the high EPSS-relevant severity and pre-auth RCE impact warrant priority patching on any NGOAM-enabled fabric.
Unauthenticated remote command execution in Splunk Enterprise search head cluster members allows any network-reachable attacker to run operating-system commands as the Splunk service account. The flaw (CWE-306) is that the Patroni REST API exposed on a search head cluster member performs critical configuration operations without requiring authentication, so an attacker who can reach that interface can invoke it directly - no credentials needed. Only deployments running search head clustering on Splunk Enterprise versions below 10.4.3 or below 10.2.7 are exposed; 10.0.x and 9.4.x are explicitly unaffected. CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects a maximum-severity, low-complexity path with full confidentiality, integrity and availability impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, so exposure is driven mainly by whether the Patroni REST API port is reachable from untrusted networks.
Unauthenticated SQL injection in the OrdaSoft Simple Membership extension for Joomla (versions before 7.4.0) allows any remote attacker to read and manipulate the site's backend database through crafted input to the checkLoginPass task. The site/simplemembership.php endpoint dispatches task=checkLoginPass with no authentication or access-control check and concatenates the login request parameter straight into a SQL query with no escaping or parameterization, which scores 9.3 under CVSS 4.0 with PR:N and no user interaction required. Exploitation needs only that the component be installed and enabled on a publicly reachable Joomla site - no credentials, user interaction, or non-default setting - and no public exploit identified at time of analysis.
Unauthenticated remote attackers can bypass the cryptographic signature verification on authentication tokens in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem), so a forged JSON Web Token is accepted as authentic and the licensing server can be fully compromised; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 10.0, meaning no credentials and no user interaction are required, low complexity, a scope change, and high impact to confidentiality, integrity and availability. Cisco's internal hardening review addressed this together with other internally discovered issues, and the advisory-linked hardening releases are the fix path, with no exact patched version numbers disclosed in the available data; the practical limiting factor is network exposure of the management/licensing interface, since the attacker must be able to reach the instance. No CISA KEV entry exists and no public exploit code has been identified at time of analysis, so this is a maximum-severity but not yet observed-exploited issue.
Pre-authentication server-side request forgery in the SonicWall SMA1000 Appliance's Work Place interface lets a remote attacker who can reach the appliance abuse an unintended alternate access path that bypasses authentication and coerce the device into issuing requests on the attacker's behalf, reaching internal functionality that is not otherwise exposed externally (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - high confidentiality impact, low integrity impact, no availability impact). Affected builds are SMA1000 12.4.3-03526 (platform-hotfix) and older, and 12.5.0-02952 (platform-hotfix) and older; because the Work Place portal is normally internet-facing on these remote-access appliances, exposure is broad and this is a genuine top-priority vulnerability rather than a high-CVSS-but-low-risk artifact. No public exploit identified at time of analysis, and exploitation requires only default network reachability with no credentials and no user interaction, so the practical impact is bounded mainly by which internal services the appliance can reach through the forged requests.
Unauthenticated command injection in the Fanvil X7A IP phone's web management portal (firmware 2.6.0.1182) lets any attacker who can reach the diagnostic ping tool execute arbitrary commands with the privileges of the underlying Android operating system, resulting in total device compromise (CVSS 10.0, scope-changed, S:C). No credentials or user interaction are required (PR:N/UI:N), publicly available exploit code exists, and CISA's SSVC assessment rates the flaw fully automatable with total technical impact, so any deployment with the portal reachable from untrusted or flat networks should be assumed exploitable at scale. In correctly segmented environments the real-world attacker population is limited to hosts with management-VLAN or LAN reachability to the phone's portal.
Remote code execution can result in IBM Langflow OSS 1.0.0 through 1.12.2 through a dependency confusion weakness, where the product resolves an expected dependency from a public package registry instead of the intended trusted source. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates an unauthenticated remote attacker with no user interaction required, and the unpatched severity is rated 9.8; however, our independent assessment lowers the attack complexity to AC:H because successful exploitation depends on the attacker knowing or guessing the exact dependency name and on the victim's resolver preferring an attacker-published public package over the legitimate one, typically during an install, build, or import event rather than against a running service. There is no confirmed active exploitation (CISA KEV does not list this CVE), SSVC records Exploitation: none and Automatable: no, no public exploit code has been identified at time of analysis, and EPSS is only 0.68% (51st percentile), so the practical near-term risk is materially lower than the 9.8 headline suggests. A vendor patch is available per the IBM advisory.
Remote code execution in LMCache multiprocess (distributed) mode allows unauthenticated attackers to execute arbitrary code as the LMCache process user by sending a crafted msgpack message with extension code 1 to the ZeroMQ ROUTER transport (default TCP port 5555). The flaw occurs because DeviceIPCWrapper.Deserialize calls pickle.loads on untrusted data before the request handler runs; official container images run as root, amplifying impact. Network exploitation requires the operator to have configured a routable --host for multi-node deployments (default binds to localhost), and no public exploit code has been identified at time of analysis.
Homer (sipcapture/homer-app) deployments running in the default internal authentication mode bootstrap an administrator account with the hardcoded credentials admin / sipcapture and never force a password change, so any unauthenticated attacker who can reach the /api/v3/auth login endpoint can obtain a full admin JWT on a freshly deployed instance. The GitHub advisory publishes working exploit code (a two-request curl sequence against /api/v3/auth and /api/v3/users), and no lockout, rate limiting, or first-login change requirement is in place, making publicly available exploit code exist for this CWE-798 hardcoded-credential flaw. Vendor fixes ship in Homer 11.0.283 (commit b2e942031ff8cd7435a244ebef306ee97d16b809), which replaces the fixed bootstrap hash with a random password logged once at startup or an operator-supplied admin_password_hash.
Unauthenticated remote code execution in the NX-API feature of Cisco NX-OS Software lets a remote attacker who can reach the NX-API listener run arbitrary code with root privileges, or crash processes hard enough to force a device reload (DoS), by sending a single crafted HTTP request. Exposure is conditional: NX-API is an optional, non-default feature, so only NX-OS devices and UCS-managed systems where it has been explicitly enabled are vulnerable to an attacker with routing access to the management/HTTP endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required once that exposure exists. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 severity, root-level impact, and full CIA loss make this a high-priority item for any environment exposing the NX-API management plane.
Remote code execution and denial of service in Cisco NX-OS Software are possible when the SRv6 OAM (NGOAM) and SRv6 features are both enabled, due to a stack-based buffer overflow (CWE-121) from improper input validation of IP traffic. An unauthenticated, remote attacker with network reachability to an IP interface can send crafted packets to execute arbitrary code with root privileges or cause a reload, resulting in a DoS condition. Exploitation requires the non-default configuration of both NGOAM and SRv6 features; no public exploit was identified at time of analysis, and no CISA KEV listing exists.
Remote code execution with root privileges and denial-of-service in Cisco NX-OS Software can be triggered by unauthenticated network attackers when the NGOAM (VXLAN OAM) feature is enabled. Crafted IP packets sent to a device IP interface exploit improper input validation (stack buffer overflow, CWE-121), allowing arbitrary code execution or process crashes that reload the device. No public exploit identified at time of analysis; the non-default NGOAM configuration requirement limits exposure, but this remains a high-priority vulnerability per our independent assessment.
Unauthenticated, remote code execution with root privileges and denial of service in Cisco NX-OS Software on Nexus 3000 Series and Nexus 9000 Series switches, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A crafted MPLS echo-request packet sent to an IP address on an affected device is processed without proper validation, letting an attacker execute arbitrary code as root and crash critical processes, which can force a device reload. The decisive exposure prerequisite is that the MPLS OAM feature must be enabled and reachable, and MPLS OAM is not on by default in most deployments; there is no public exploit identified at time of analysis and no KEV listing is indicated by the provided intelligence.
Missing authentication in the HOMER (sipcapture Homer) coordinator allows remote unauthenticated attackers to fully control the administrative API whenever the JWT signing secret is left at its default empty value. Because JWTMiddleware and JWTMiddlewareV4 both short-circuit with next(c) when the secret is empty - and the middleware is not even registered on the protected route groups in that state - every endpoint under /api/v1, /api/v3 and /api/v4 is reachable without credentials, permitting reads and writes of users, configuration, database connection strings and stored VoIP call data, including creation of a new admin user. The flaw carries a 9.8 CVSS (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-306, is unauthenticated by vector, and a vendor fix is available per the advisory; exploitation status is no public exploit identified at time of analysis, though the vendor advisory itself contains curl-based reproduction steps.
Missing authentication for critical functions in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem) lets unauthenticated remote attackers reach protected functionality with no credentials and no user interaction, exposing confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The issues were discovered during Cisco's own internal security review and are bundled into a hardening release documented in Cisco advisory cisco-sa-hardening-ssm-Ph77wdhf rather than being tied to a single feature or endpoint. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but because the licensing server is frequently deployed on internal networks with broad reach to managed devices and license data, any internet- or flat-network-exposed instance should be treated as an urgent patch priority.
PHP object injection in The Events Calendar WordPress plugin (all versions through 6.17.4, published by Liquid Web / StellarWP) allows an attacker to pass crafted serialized data into a deserialization code path and instantiate arbitrary PHP objects, which can escalate to code execution, data theft or full site compromise if a usable POP gadget chain exists in the plugin, WordPress core or any other installed theme/plugin. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remote, unauthenticated, no-interaction attack, but the advisory does not name the vulnerable endpoint, and comparable Patchstack object-injection findings frequently require at least a low-privilege authenticated session; our independent assessment therefore keeps the same impact ratings while treating exploitability as high-complexity (AC:H). There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by whether a reachable gadget chain is present on a given WordPress installation rather than by confirmed active exploitation.
Unauthenticated remote attackers who can reach the management/API plane of the Cisco Application Policy Infrastructure Controller (APIC) could potentially achieve full compromise of confidentiality, integrity, and availability, as reflected by the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue was discovered by Cisco's own engineering team during an internal security review of APIC and falls under CWE-664, the improper control of a resource through its lifetime; affected coverage in the supplied CPE is a wildcard for all APIC versions, so no specific vulnerable build range is enumerated. At time of analysis there is no public exploit identified and no CISA KEV confirmation, although APIC's role as a data-center SDN controller on typically isolated management networks is the principal practical barrier to exploitation rather than any input-confirmed technical prerequisite.
Improper neutralization flaws in Cisco Application Policy Infrastructure Controller (APIC), the software controller for Cisco ACI data-center fabrics, allow unauthenticated network-reachable attackers to achieve full confidentiality, integrity, and availability impact - the input assigns CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issues were found during Cisco's own internal hardening review and are bundled as a single CVE covering multiple CWE-707 (Improper Neutralization) weaknesses rather than one disclosed trigger path; no specific protocol, endpoint, or non-default configuration prerequisite is documented. No public exploit code and confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Practically, exploitability hinges on reachability of APIC management/controller interfaces, which are normally confined to isolated out-of-band management networks, so real-world exposure is largely limited to insiders or attackers who have already pivoted into the management segment. Patches are available per the Cisco advisory cisco-sa-hardening-apic-UOXWtfh; because the reference is a hardening release rather than a single tagged fix, an exact fixed version string was not provided in the input data.
Unauthenticated remote access-control bypass in Cisco APIC gives network-reachable attackers full compromise of confidentiality, integrity, and availability (CVSS 9.8) against the ACI data-center controller. The CVE groups multiple internally discovered improper access control issues (CWE-284) addressed by Cisco hardening releases, and the provided data does not enumerate exact affected versions, so the Cisco advisory must be used to confirm vulnerable releases. No public exploit identified at time of analysis; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is remotely reachable without authentication or user interaction, though real-world exposure depends on reachability to APIC's typically isolated management/API plane.
Improper access control in Cisco NX-OS - including NX-OS running in ACI mode and the NX-OS component of managed Cisco Unified Computing System deployments - could allow a remote, unauthenticated attacker to bypass access restrictions and achieve full compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue was identified during a Cisco internal security review and is addressed in a NX-OS software hardening release rather than a single-point bug fix, with the advisory grouping multiple internally discovered access-control weaknesses under CVE-2026-76455. At time of analysis no public exploit code or confirmed active exploitation has been identified, and the specific vulnerable feature, protocol, or configuration mode is not disclosed in the available data, so exposure must be validated against the Cisco advisory before triage.
Out-of-bounds write defects in Cisco NX-OS Software - spanning standalone NX-OS switches, NX-OS System Software running in ACI mode, and NX-OS-based software managed through Cisco UCS - carry a vendor CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning a remote, unauthenticated attacker with network reachability could potentially cause high confidentiality, integrity, and availability impact. The issues were discovered during a Cisco internal security review and are delivered as part of a bundled software hardening release rather than a single pinpointed defect, so the affected subsystem, protocol, or port is not enumerated in the available data. At time of analysis there is no public exploit identified, CISA SSVC records exploitation as 'none' with automatable 'no', and EPSS is low at 0.28% (19th percentile), indicating manual, targeted rather than scalable risk.
Unauthenticated users who can reach the websocket handler on a Fanvil X7A device running firmware 2.6.0.1182 can read operational logs and issue diagnostic requests without ever establishing a session, because the handler does not enforce authentication for sessionless connections. The affected scope is narrowly defined: only that specific firmware build is reported, and exploitation requires nothing more than network reachability to the device's management websocket, with no credentials, user interaction, or configuration change (CVSS vector PR:N/UI:N, and the upstream advisory rates it 9.8). Signals around this issue conflict: MITRE scores it 9.8/C:H/I:H/A:H, while the independent assessment lands at 8.6 with C:H/I:L/A:L, and EPSS is low at 0.19% (8th percentile) with no public exploit code identified at time of analysis and no CISA KEV listing, so real-world risk is driven far more by whether the device is exposed than by current exploitation activity.
Improper neutralization (injection-class weakness, CWE-707) in Splunk Enterprise lets an attacker submit crafted input through a network-reachable Splunk interface and achieve high impact across confidentiality, integrity, and availability - per our independent assessment, exploitation requires low-privilege authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), even though the upstream NVD-style vector claims PR:N/unauthenticated. Affected are Splunk Enterprise 10.4 before 10.4.3, 10.2 before 10.2.7, 10.0 before 10.0.10, and 9.4 before 9.4.15; the vendor grouped multiple internally identified findings by CWE and assigned this CVE to the neutralization group, so the advisory names no single endpoint or feature. No public exploit code has been identified at time of analysis, EPSS is only 0.15% (4th percentile), and the vulnerability is not listed as confirmed actively exploited (CISA KEV), so urgency should be driven by the critical severity and the accessibility of the affected interface rather than by observed exploitation.
Splunk Enterprise installations at versions below 9.4.15, 10.0.10, 10.2.7, and 10.4.3 are affected by a coding-standard defect that the vendor rates at CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning a remote, unauthenticated network attacker could in principle achieve full loss of confidentiality, integrity, and availability. The issue is one of several internally identified findings that Splunk grouped under CWE-710 (Improper Adherence to Coding Standards) and documents in advisory SVD-2026-1002; because the advisory groups multiple defects by weakness class, it does not enumerate the specific component, feature, or configuration prerequisite involved, so the exact attack path cannot be confirmed from available data. Practical risk is presently tempered: EPSS is only 0.14 percent (3rd percentile) and there is no public exploit identified at time of analysis, with no CISA KEV listing indicating confirmed active exploitation; the dominant exposure factor is network reachability to the Splunk web interface or management port, which in many enterprise deployments is restricted to internal networks rather than internet-exposed.
Unauthenticated command injection in the Fanvil x7a IP phone's web management portal (firmware 2.6.0.1182) allows any attacker who can reach the portal's diagnostic ping tool to inject shell metacharacters and execute arbitrary commands on the underlying Android operating system, compromising confidentiality, integrity and availability equally (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The practical gating factor is exposure: the portal is normally reachable only from a LAN or management VLAN, so risk falls sharply wherever it is not reachable from untrusted networks. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis - CISA's SSVC rates Exploitation as 'none' while classifying the flaw as automatable with total technical impact, meaning exploitation could spread quickly once a proof-of-concept surfaces.
Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless range trigger memory-safety failures on Cisco Meraki MR wireless access points, MV cameras, MX appliances, and Campus Gateway software, with the grouped advisory rated CVSS 9.6 (scope change plus high confidentiality, integrity, and availability impact). Exploitation requires the attacker to already sit on the same broadcast domain, Layer 2 segment, or RF coverage area - the flaw is not reachable from the routed internet - and the hardening bulletin does not disclose which protocol or feature actually triggers the CWE-119 condition. No public exploit code or confirmed active exploitation was identified at time of analysis; the fix ships as part of a vendor internal hardening release rather than a discrete single-version patch.
Authenticated users holding only the low-privileged 'Backup Viewer' role on Veeam Backup & Replication can leverage a deserialization flaw to execute arbitrary code as SYSTEM on the backup server, turning a read-only backup monitoring account into full control of the backup infrastructure (CVSS 9.4; CWE-502). The attack is network-reachable (AV:N) and requires no user interaction, but it is not unauthenticated: a valid Backup Viewer account or stolen credentials for that role are mandatory (PR:L), which realistically limits exposure to insiders, credential-theft scenarios, or attackers who have already chained into the environment. The high severity is compounded by the scope change (S:C) and full loss of confidentiality, integrity, and availability across the backup server and connected systems; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote code execution in LMCache through 0.5.5 allows network-reachable attackers to execute arbitrary Python and operating-system commands as the LMCache process by posting scripts to the /run_script endpoint; the endpoint's existing __import__ guard is bypassed via the injected FastAPI app object, which exposes real builtins (CWE-306, CVSS 9.3 v4.0 / 3.1 AV:N/AC:L/PR:N/UI:N). No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, though the vulnerability details and vendor advisory are public. The primary limiting factor is deployment exposure: exploitation requires the internal API HTTP server to be enabled and bound to a network-accessible interface rather than restricted to localhost or a trusted management network.
Cross-host request replay in AsyncHttpClient (AHC) before 3.0.13 and 2.16.1 can disclose the original origin's request path, Host header, Authorization credentials, or even a plaintext request to a completely different destination when an application's ResponseFilter fails over or retries a request onto a different base origin (host, scheme, or port) or downgrades HTTPS to HTTP. The assessed vector is unauthenticated from the network perspective (PR:N, AV:N), but exploitation hinges on a concrete application-side prerequisite: a ResponseFilter (or equivalent retry/failover code path) that replays requests across origins - default AHC usage with same-host retries is unaffected, and AC:H/AT:P reflect the specific sequencing that must occur. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because the impact depends on configuration rather than an attacker-reachable endpoint, the CVSS 4.0 score of 9.4 and the independent CVSS 3.1 assessment point in different directions; prioritization should be driven by whether a cross-host replaying filter is deployed.
Session fixation and cross-user session reuse in the Apache Jackrabbit WebDAV server lets remote attackers ride on a cached authenticated session, yielding high confidentiality and integrity impact with no credential check performed. The flaw affects Jackrabbit 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5, and is triggered whenever a request carries a Lock-Token, TransactionId, SubscriptionId, or If-header token value that matches a token bound to a session already held in the server's authenticated session cache. Per the vendor CVSS 4.0 vector the attack is network-reachable, requires no privileges (PR:N) and no user interaction (UI:N), with the practical limiting factor being that the attacker must obtain or guess a token that currently maps to a live cached session; no public exploit code has been identified at time of analysis, and the product does not confirm active exploitation.
Unauthenticated remote code execution in Manacle Multi-Tenant ERP allows attackers to execute arbitrary code or manipulate application data through unsafe deserialization of user-controlled input (CWE-502). The vulnerability (CVE-2026-107104) is rated critical with a CVSS 4.0 score of 9.3 and requires no privileges or user interaction to exploit (PR:N/UI:N). No public exploit or active exploitation is known at time of analysis, but the high impact to confidentiality and integrity, combined with network reachability, makes this a high-priority risk.
Unauthenticated remote attackers who can reach the lmadmin management service can seize a privileged administrator session by abusing a hardcoded authentication path in its SOAP handler, granting full control over the license server's administrative functions. The flaw is rated CVSS 9.3 by the reporter and was independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no credentials or user interaction are required and the confidentiality, integrity and availability impacts are all high. No public exploit code or confirmed active exploitation was identified at time of analysis, but the low complexity, network vector and administrative payoff make this a genuine high-priority issue for any organization exposing lmadmin beyond a trusted management network.
Unauthenticated SQL injection in the Manacle Multi-Tenant ERP System's API endpoint allows remote attackers to inject arbitrary SQL through crafted input, giving high impact to both data confidentiality and integrity (CVSS 4.0 score 9.3; assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N). The affected CPE (cpe:2.3:a:manacle_technologies:multi-tenant_erp_system:*) carries no version constraint, indicating the flaw is described against the product as a whole rather than a bounded release range, and no fixed version is named in the advisory. There is no public exploit identified at time of analysis and no CISA KEV listing; no EPSS score was supplied in the source data, so likelihood of exploitation should be judged from exposure alone.
Cross-site scripting in ASUS router web-management modules lets a remote, unauthenticated attacker read DOM information from the administrator's browser session, modify router settings, and drive the device into a denial-of-service condition when a logged-in administrator is induced to visit a crafted URL. The vendor assigns this CWE-79 flaw a CVSS 4.0 base score of 9.3 (Critical), and the weakness affects ASUS router firmware generally per the wildcard CPE, with no specific model or firmware versions enumerated in the available data. Successful exploitation still depends on social engineering and on a legitimate administrator being actively authenticated to the management interface at the time the link is opened; no public exploit code was identified at time of analysis and no EPSS score or CISA KEV listing is present in the source data.
Guest-to-host code execution in VMware Workstation and Fusion 25H2 and 26H1 lets an attacker who already holds local administrative privileges inside a guest VM equipped with the VMXNET3 virtual network adapter escape the hypervisor isolation boundary and run code on the host. The flaw is an integer overflow (CWE-190) in the virtual NIC's device emulation and carries a CVSS 9.3 with Scope:Changed, placing it in the most severe class of hypervisor defects; it is not remotely reachable, since the attacker must first obtain a guest admin foothold and the target guest must use a VMXNET3 adapter. No public exploit code has been identified at time of analysis, and patched builds are available as 26H1u1 for both products.
Unauthenticated authentication bypass in Manacle Technologies' Multi-Tenant ERP System lets a remote attacker forge payment-callback requests to mint a valid authenticated session as an arbitrary user, yielding full read and write access to that account and, given the multi-tenant design, potentially to data across tenant boundaries. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) this is a genuine high-priority issue rather than an inflated score: exploitation requires no credentials and no user interaction, but it does depend on the payment-callback API being network-reachable and on the payment-integration feature being enabled and in use. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the CPE data does not pin specific affected versions.
Blind SQL injection in the WordPress WP Data Access plugin through version 5.5.82 could allow a remote attacker to read sensitive database contents; the supplied CVSS vector rates it 9.3 with PR:N, indicating network-reachable unauthenticated exploitation, though the provided advisory data does not independently corroborate the unauthenticated condition and comparable plugin SQLi often requires at least subscriber-level access. This is a genuine high-priority issue by severity signals but with important caveats, and no public exploit identified at time of analysis.
Out-of-bounds write in the TLS 1.3 client of Eclipse ThreadX NetX Duo 6.5.1.202602 allows a malicious or compromised server to corrupt memory in the session control block by sending an oversized handshake message before certificate authentication completes, potentially achieving code execution or causing denial of service. The flaw is client-side and unauthenticated from the network perspective, requiring the victim device to initiate a TLS 1.3 handshake to an attacker-controlled server; no valid server certificate is needed and certificate pinning does not prevent exploitation. No public exploit code was identified at time of analysis, but the CVSS 9.3 base score and the pre-authentication nature make this a high-priority memory-corruption issue for affected embedded deployments.
A stack-based buffer overflow in ASUS router firmware modules lets an attacker who already holds administrative credentials on the device and is connected to the same local or Wi-Fi network segment execute arbitrary code by uploading a crafted configuration file that exceeds an expected buffer size. The flaw is rated CVSS 4.0 9.3 (Critical) and assessed as CVSS 3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, because successful exploitation yields full compromise of confidentiality, integrity and availability of the router, although the adjacent-network (AV:A) and high-privilege (PR:H) requirements exclude anonymous Internet-wide attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; vendor guidance is available through the ASUS Security Advisory.
Unauthenticated arbitrary file read affects ASUSTOR ADM 4.1.0 through 4.3.3.RWC1 and 5.0.0 through 5.1.4.RL21, where a single crafted HTTP request to start-page-loader.cgi injects headers through the state parameter and abuses the underlying web server's X-Sendfile mechanism to return the contents of sensitive files on the host. No credentials or user interaction are required and default configurations are exploitable, making internet-exposed NAS web interfaces the highest-risk deployment, while LAN-only devices require attacker network presence; the flaw is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis. The independent assessment rates this as a genuinely high-priority confidentiality-only flaw (CVSS 3.1 scope-changed, C:H/I:N/A:N; CVSS 4.0 base 9.2) rather than a CVSS-inflated one.
Unauthenticated code injection in the upgrade script shipped with Movable Type allows a remote attacker to execute an arbitrary Perl script or run an SQL query against the affected installation once the upgrade handler is reachable over the network. The flaw affects Movable Type, Movable Type Premium, and their Cloud Editions (Six Apart), and carries a critical severity rating (vendor CVSS 9.4; our assessment scores availability impact as High rather than Low, yielding CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required, but the practical prerequisite is exposure of the installation/upgrade endpoint: sites that remove, restrict, or firewall the upgrade script after installation are substantially less reachable, while sites leaving it publicly accessible are directly exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the immediate risk is driven by mass internet exposure of the endpoint rather than by observed attacks.
Unauthenticated account takeover in Sungrow iSolarCloud is achievable by sending a login request to the platform's API with "login_type":"5" and the victim's email address in the user_account property, letting an attacker assume control of an arbitrary account without valid credentials. The affected range is stated as iSolarCloud builds 'before 2026' (CPE is a wildcard, so no exact fixed build is published), and because iSolarCloud is the control plane for grid-connected PV and battery-storage fleets, the assessed impact is scope-changed (S:C) with high integrity and availability loss - the disclosure's author cautions about regional blackouts in Europe, which should be read as worst-case rather than demonstrated. No public exploit code has been identified at time of analysis, and the principal operational constraint is knowing a target email, which the report notes is obtainable by a legitimate sub-account holder who can view the email associated with their parent organization.
Unauthenticated remote attackers can write arbitrary files or cause a denial-of-service condition on Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) via the Cisco Smart Licensing Utility management API. The vulnerability arises from improper input validation and missing authentication, allowing crafted requests to traverse paths and modify system files or disrupt service. No public exploit code exists and exploitation has not been confirmed as active (CISA KEV); exploitation requires only network reachability to the management API.
Unauthenticated remote attackers can reset the password of any account, including administrative users, in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) by exploiting improper authorization checks in the web-based password-reset function, leading to full application compromise. The flaw has a CVSS score of 9.1 (AV:N/AC:L/PR:N/UI:N) and requires only network reachability to the management interface; no public exploit has been identified at time of analysis. Deployments exposing the interface to untrusted networks are at highest risk, while well-segmented instances are materially harder to attack.
Heap memory corruption in llama.cpp's chat/tool parser lets unauthenticated remote attackers crash llama-server and potentially shape a controlled heap write primitive by sending a crafted POST /completion request containing a chat_parser that emits a tool-id token after a tool-close tag. Versions prior to build b11393 are affected; the trigger leaves the mapper's current_tool pointer dangling, producing a use-after-free and double-free in common_chat_peg_mapper::map. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 4.0 score of 9.2 reflects high confidentiality, integrity and availability impact, and the independent assessment confirms high severity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) - reliable denial of service is straightforward, while converting the bug into a controlled heap write requires heap grooming. A vendor patch exists as upstream PR/commit and as build b11393.
Unauthenticated network access to the WebSocket handler on Fanvil X7A desk phones running firmware 2.6.0.1182 exposes device internals: any client able to reach the interface can read operational logs and issue diagnostic requests without a session, credentials, or user interaction (CWE-306, missing authentication for a critical function). NVD rates this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), while the independent assessment adjusts integrity impact to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) and treats the exposure as a genuine access-control flaw rather than a top-tier emergency. No public exploit code was identified at time of analysis and CISA's SSVC decision point records no observed exploitation, so practical risk hinges on whether the phone's WebSocket/management interface is reachable beyond the local VoIP VLAN.
Remote, unauthenticated attackers can reach insufficiently protected credentials in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) and potentially read and modify them, based on Cisco's hardening advisory covering several internally discovered CWE-522 issues tracked under this single CVE. Cisco rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality and integrity impact but no availability impact. The wildcard CPE cpe:2.3:a:cisco:cisco_license_on-prem:*:*:*:*:*:*:*:* indicates all shipping versions are affected until the vendor's hardening release is applied; no public exploit code or confirmed active exploitation was identified at time of analysis (no CISA KEV listing and no PoC referenced), and practical exposure is constrained because these on-prem appliances normally sit on internal management networks rather than the public internet.
Python code injection in PraisonAI's deploy tooling (all versions up to and including 4.6.77) lets a high-privileged actor who controls the `agents_file` value break out of an f-string and execute arbitrary code on the host running the deploy command. The flaw is triggered at build/deploy time: the unsanitized value is interpolated into generated server or Dockerfile source in `deploy/api.py` and `deploy/docker.py`, written to disk, and then launched via `subprocess.Popen(['python', server_file])`, so the primary realistic exposure is CI/CD pipelines or shared build environments where `agents_file` originates from externally influenced configuration. The vendor advisory includes a proof-of-concept demonstrating the string-breakout payload and a fix is available in 4.6.78; no CISA KEV entry or other confirmation of active exploitation was present in the source data, and this is not a remotely reachable flaw in a default running service - exploitation requires the attacker to already be positioned to set or tamper with deploy-time input and for someone to invoke the deploy command.
Command injection in h-ui v0.0.25 and earlier allows an authenticated administrator to execute arbitrary OS commands as root by supplying shell metacharacters in the 'listen' configuration field of the administrative API. Because the application builds nftables/iptables rule strings with fmt.Sprintf and runs them through bash -c with root privileges, a successful injection yields full host compromise with high confidentiality, integrity, and availability impact. Exploitation requires valid administrative credentials plus the ability to set the listen field, so realistic risk concentrates on multi-operator or weakly-secured panels; no public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released patch has been identified.