Unauthenticated remote attackers can cause a persistent denial of service on Absolute Secure Access servers running versions prior to 14.60 by sending specially crafted traffic to the connection setup subsystem. The flaw affects only availability (CVSS 4.0 score 8.7, CVSS 3.1 A:H), with no impact to confidentiality or integrity. A vendor patch is available in version 14.60; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Octopus Server lets an authenticated user who already holds permission to modify roles weaken a built-in role's protections and add their own account to a privileged team, effectively granting themselves administrative reach without ever being assigned those rights legitimately. The flaw stems from improper validation of unsafe equivalence in input (CWE-1289), meaning role/permission data that should not be treated as equivalent is mishandled during validation. The primary limiter is the prerequisite: the attacker must already have been delegated role-modification rights, so environments that keep that permission confined to a small trusted administrator set face materially lower exposure. No public exploit code has been identified at time of analysis, and this CVE is not confirmed actively exploited (CISA KEV); the Octopus vendor advisory SA2026-11 is the authoritative source for affected and fixed builds.
Denial of service in Excelize 2.9.0 through 2.11.0 allows a crafted spreadsheet to panic and terminate a Go process that calls File.GetSlicers. When a worksheet contains an extLst element but the independently optional drawing element is absent, GetSlicers dereferences the nil ws.Drawing pointer while resolving the drawing relationship, producing a runtime panic; the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) indicates remote, unauthenticated triggering with high availability impact but no confidentiality, integrity, or scope impact. Exploitation is not confirmed to be occurring in real-world campaigns and no public exploit code has been identified at time of analysis, though the upstream fix commit and pull request are public, which lowers the bar for crafting a malicious XLSX; the independent assessment rates this as a moderate, impact-limited risk because GetSlicers is not part of the default file-open or parse path and any recover() wrapper neutralizes the crash.
Go slice-bounds panic in the Excelize spreadsheet library versions 2.8.1 through 2.11.0 lets a crafted .xlsx workbook crash any process or request worker that calls GetPivotTables. The library parses pivot-table field indices separately from pivot-cache field names and indexes one slice with the other without bounds checks, so a workbook with a pivot-field count mismatch or an out-of-range/negative dataField fld value triggers an unrecovered runtime panic that escapes the library (CVSS 3.1 assessed 8.7, availability-only; no authentication or user interaction required from the caller's perspective). No fixed release version is confirmed in the advisory data - only the upstream fix commit - and no public exploit code was identified at time of analysis, though exploitation requires no more than delivering a malicious workbook to a service that parses pivot tables.
Credential disclosure in the AsyncHttpClient (AHC) Java library allows a malicious or compromised origin server or proxy to capture plaintext-recoverable usernames and passwords from applications that configure HTTP credentials via Realm.Builder. When the attacker returns a WWW-Authenticate or Proxy-Authenticate challenge labeled 'Digest' but with the nonce parameter omitted or empty, versions prior to 3.0.13 (3.x) and 2.16.1 (2.x) silently fall back to Basic authentication and resend the credentials in reversible Base64, defeating the entire purpose of Digest. Exploitation is unauthenticated from the network (CVSS v4.0 8.7, AV:N/PR:N, independent assessment CVSS v3.1 C:H/I:N/A:N), but requires the attacker to control or tamper with the authentication challenge, so it is not exploitable against arbitrary endpoints; no public exploit code or CISA KEV entry was identified at time of analysis.
Remotely triggerable denial-of-service conditions in Cisco NX-OS Software - including NX-OS System Software running in ACI mode and managed Cisco Unified Computing System deployments - can cause an affected device to reload or otherwise become unavailable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) describes an unauthenticated, low-complexity, network-reachable flaw with availability-only impact and scope change, meaning the affected process can degrade resources beyond its own security boundary, but there is no confidentiality or integrity impact and no public exploit code identified at time of analysis. The issue was found during Cisco's own internal security review and is delivered as a grouped software hardening release rather than a single named feature fix, so the precise triggering traffic or configuration is not disclosed; the practical risk is loss of availability of data-center switching and fabric devices that are reachable from an untrusted network segment.
Out-of-bounds read issues in Cisco NX-OS, NX-OS in ACI mode, and managed Cisco UCS software can be triggered by remote, unauthenticated attackers to cause a denial-of-service condition (process crash/restart) on affected devices. The CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), and exploitation is limited by reachability to the vulnerable management/control-plane service, which is often segmented on management VLANs or trusted networks. No public exploit code or confirmed active exploitation was identified in the provided data, and Cisco's advisory does not name a specific protocol, port, or feature beyond the hardening release.
Unauthenticated, network-reachable input-validation flaws in Cisco NX-OS Software command processing can disrupt affected devices, and the same hardening advisory covers Cisco NX-OS System Software running in ACI mode as well as the NX-OS component of Cisco Unified Computing System (managed). Cisco scores it 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), so the assessed impact is availability-only with a scope change and no confidentiality or integrity effect. The issue was discovered during Cisco's internal security review and is addressed by a hardening release rather than by any observed attack activity, and no public exploit code or CISA KEV entry is associated with it at time of analysis.
Hard-coded cryptographic key material embedded in Johnson Controls ADVMS builds prior to 3.10 lets a locally authenticated, low-privileged user read sensitive constants out of the application executable and recover a key that was never meant to be exposed. Because the key is static across affected installations, anything protected by it - encrypted data, authentication material, or inter-component trust - can be decrypted, spoofed, or reused by anyone who extracts it, producing high confidentiality, integrity, and availability impact on the affected host. The issue is local-only (CVSS v4.0 AV:L/AC:L/PR:L/UI:N), is not confirmed actively exploited (not in CISA KEV), and has no public exploit identified at time of analysis; upgrading to 3.10 or later removes the condition.
OS command injection in patool's Windows argument-quoting routine lets a crafted archive filename (for example report&calc.gz) break out of quoting and run arbitrary commands through cmd.exe with the privileges of the patool process. All patool releases before 4.0.6 are affected, but only when patool runs on a Windows host and processes an attacker-supplied archive; the vulnerable path is the single-file-format extraction flow that invokes the shell, and exploitation requires the victim to actively run patool against the malicious file (passive user interaction). No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the CVSS 4.0 base score of 8.5 (High) reflects total confidentiality, integrity and availability impact within the local execution context, tempered by the Windows-only, user-assisted attack preconditions. Authentication is not required to trigger the flaw (CVSS 4.0 vector PR:N).
Heap-based buffer overflow in X.Org X server and Xwayland GLX RenderLarge request handling allows an authenticated local X client to write past the allocated heap buffer, potentially achieving arbitrary code execution or causing denial of service. Affected versions are xorg-server prior to 21.1.25 and Xwayland prior to 24.1.14; the attacker must already be able to open an X display with GLX available, which by default means local Unix-socket access rather than remote unauthenticated access. No public exploit identified at time of analysis.
Certain ASUS router models write DDNS (dynamic DNS) account credentials into the readable system log, so an attacker who already holds high-privilege administrative access and sits on the same or an adjacent network segment (LAN/Wi-Fi) can harvest those secrets from the log and potentially redirect DNS settings. The exposure is confirmed by the vendor (ASUS) and rated 8.4 High under CVSS 4.0, but the prerequisite of authenticated management access plus network adjacency makes it a context-dependent, moderate-priority issue rather than a mass-exploitable one; no public exploit code has been identified at time of analysis and no CISA KEV listing applies. The leak only yields credentials on devices where DDNS is actually configured and enabled.
Email address disclosure in the User Private Files WordPress plugin before version 2.1.9 allows any authenticated user - including a low-privileged Subscriber - to retrieve the email address of any registered account on the site, including administrators. The plugin fails to verify that a supplied user actually belongs to the document being operated on, so an attacker with a valid account can simply supply arbitrary user identifiers and read back the associated email addresses. Publicly available exploit code exists (documented by WPScan), no CISA KEV entry confirms active exploitation, and the impact is limited to confidentiality (CVSS 4.3, C:L) with no data modification or service disruption - making this a genuine but low-to-moderate priority issue rather than a critical one.
Broken access control in the Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 lets any authenticated user - including the lowest-privilege Subscriber role - act on and alter WooCommerce orders that belong to other customers. The flaw sits in several of the plugin's order payment-processing actions, which perform neither an authorization check nor an ownership check against the supplied order identifier (CWE-639, CVSS 4.3). Exploitation requires only a valid account and no user interaction, and publicly available exploit code exists; however, per CISA's SSVC assessment, exploitation has not been observed (no KEV listing) and the impact is bounded to order integrity with no confidentiality, availability, or privilege-escalation effect.
An authorization flaw in the Academy LMS WordPress plugin before 4.0.0 allows any authenticated user who is enrolled in at least one course - such as an ordinary student - to read the quiz answer options for questions that belong to other courses they are not enrolled in. Because the plugin fails to verify that a referenced quiz question actually belongs to a course the requester can access, a valid session plus minimal enrollment is enough to pull answer data across course boundaries; publicly available exploit code exists, though there is no evidence of confirmed active exploitation. Independent assessment rates this as a genuine but low-priority issue - authentication is mandatory (PR:L), no anonymous exploitation is possible, impact is limited to confidentiality of quiz answers (no write, no takeover), and the attack is not automatable at scale per SSVC (Automatable: no).
Information disclosure in the Academy LMS WordPress plugin before 4.0.0 allows an authenticated student - including one who simply self-registers when open registration is enabled - to read the full content of arbitrary lessons through an under-protected REST API route, including lessons belonging to paid or private courses they are not enrolled in. The issue is an authorization/ownership-check failure (CWE-639) rated CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and publicly available exploit code exists, although CISA's SSVC assessment records no observed exploitation and classifies the issue as not automatable. Impact is bounded to confidentiality of lesson content - no data modification, no site disruption - and installations that disable open student self-registration materially raise the barrier to entry.
Authenticated users with subscriber-level privileges can delete the Frontend Dashboard WordPress plugin's configured profile and post form fields in versions before 3.0.0 due to a missing capability check in an AJAX action. This broken access control flaw (CWE-284) has a CVSS score of 4.3 and publicly available exploit code, but no confirmed active exploitation. The risk is moderate because exploitation requires a low-privilege account and only affects data integrity, not confidentiality or availability.
Authenticated Cloud Connect tenants can read arbitrary files on the Veeam Backup & Replication service provider host through a path traversal flaw (CWE-22). This affects service providers that deploy the Cloud Connect feature and serve tenants; standalone installations without Cloud Connect are not reachable via this tenant path. The attack is network-reachable and low-complexity with no user interaction, but impact is limited to read-only disclosure and no public exploit code or confirmed active exploitation has been identified at time of analysis. This is a credible, above-average priority for Veeam Cloud Connect service providers, though not a drop-everything emergency on current signals.
Denial of service in Absolute Secure Access servers before version 14.60 allows unauthenticated remote attackers to cause a persistent outage by sending a malformed response during the authentication handshake. The attack requires network access to the authentication interface and no authentication, but its high complexity (AC:H) means specific conditions must be met, limiting trivial exploitation; no public exploit code has been identified at time of analysis. Impact is confined to availability with no confidentiality or integrity consequences.
Improper input validation in Cisco Meraki MR wireless access point, MV camera, and MX security appliance firmware - together with Cisco Campus Gateway Software - allows unauthenticated remote attackers to feed crafted input that the affected device fails to validate, producing a high integrity impact and a limited availability impact (C:N/I:H/A:L) under the assessed CVSS 3.1 vector. The issue is one of a set of CWE-20 weaknesses remediated in a single Cisco internal-hardening firmware release, so the specific vulnerable feature, protocol, or interface is not named and the affected version boundaries must be taken from the Cisco advisory. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); note that the 'Information Disclosure' tag does not align with the assessed vector, which shows no confidentiality impact.
ImageMagick's CUT image decoder fails to enforce the configured security policy (policy.xml) when it derives and opens the companion '.PAL' palette file next to a processed CUT image, so an unauthenticated remote attacker who can get a crafted CUT file into an image-processing pipeline can read a palette file that policy explicitly denies and can also crash the process. All releases before 7.1.2-31 (including the entire 7.0.0 line) and before 6.9.13-56 are affected; the flaw is only meaningful when a restrictive read policy is actually in place, since the practical impact is limited to policy bypass for one adjacent file plus a denial-of-service crash, with no write or code-execution capability. Advisory GHSA-r868-pmwh-fv2c has been published with upstream commits and fixed release tags, EPSS is low at 0.12% (2nd percentile), and CISA's SSVC assessment rates exploitation as none and automatable as no, so no public exploit code has been identified at time of analysis.
SQL injection in the Homer coordinator's POST /api/v4/statistics/query endpoint allows a remote attacker to execute arbitrary DuckDB SQL against the FlightSQL backend, exposing or altering all stored VoIP call records, SIP messages and metadata. The V4StatisticsQuery handler forwards the caller-supplied rawquery field verbatim to DuckDB without the sqlvalidator.ValidateRawSQL() neutralization applied in sibling handlers, so any authenticated user is sufficient (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1); the vendor notes that on default deployments an empty JWT secret collapses this to pre-authentication reachability. Publicly available exploit code exists (the advisory ships a working curl PoC, and DuckDB INSTALL/LOAD is reachable for extension-based exfiltration); no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Candlepin, the entitlement and subscription management engine behind Red Hat Satellite 6, contains an authorization-logic flaw in its central access control filter: when an API operation verifies multiple @Verify-annotated parameters, access is granted if any one of them is permitted rather than requiring permission on all of them. An authenticated attacker with a low-privilege account who legitimately can reach the first referenced object can therefore pass authorization checks on later parameters and, provided they know the victim resource identifiers, read consumer information or modify entitlements and subscription resources - including objects belonging to other organizations (CVSS 3.1: 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation requires a valid account and prior knowledge of target consumer UUIDs, entitlement IDs, or subscription resource IDs, and is limited to endpoints that evaluate more than one verified parameter; no public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
An integer underflow in Zephyr's IEEE 802.15.4 link-layer security receive path lets any attacker within radio range drive an out-of-bounds read and in-place write of up to roughly 240 bytes into the network buffer pool. When CONFIG_NET_L2_IEEE802154_SECURITY is enabled and a security session at a level other than IEEE802154_SECURITY_LEVEL_NONE is established, a single crafted data frame whose payload is shorter than the configured authentication tag makes payload_len wrap to as large as 255, so CCM decryption reads several hundred bytes past the end of the exactly-sized receive buffer - and this happens before the tag is ever verified, so no key material, association, authentication, or user interaction is needed (CVSS 8.1, AV:A/AC:L/PR:N/UI:N). The primary impact is memory corruption and denial of service rather than information disclosure, since the out-of-bounds bytes are not attacker-chosen and the frame is dropped when tag verification fails; no public exploit code was identified at time of analysis, and exposure is limited to builds that enable this non-default, experimental security feature.
VMware Workstation and Fusion (25H2 and 26H1) carry a stack-based buffer overflow in the HGFS Host-Guest File System component used for shared folders, letting an attacker who already holds administrative privileges inside a guest VM execute code as the VMX process on the host and thereby break the guest-to-host isolation boundary. This is a VMware guest-to-host escape, a genuinely high-value class of flaw because it defeats the primary security boundary of virtualization, though the realities of exploitation are gated: the attacker needs a pre-existing local admin foothold in the guest, HGFS must be reachable, and the CVSS vector's AC:H signals that the overflow must be shaped to bypass host memory protections. Vendor-released patch is available in Workstation/Fusion 26H1u1; no CISA KEV listing and no public exploit code was identified at time of analysis, and no EPSS score was supplied in the source data, so the practical risk concentrates on multi-tenant, untrusted-guest, or shared-lab deployments rather than single-user desktops.
Server-side request forgery in the PowerPress Podcasting plugin by Blubrry (versions 11.13.12 through before 11.17.11) lets authenticated WordPress users with contributor-level access or higher supply a media URL that the plugin fetches server-side, following HTTP redirects to attacker-chosen destinations, and thereby probe or reach internal services. The flaw is a redirect-destination validation failure classified as CWE-918 with CVSS 4.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N per the assessed vector), so impact is limited to confidentiality-oriented access to internal endpoints with no direct write or code-execution path indicated. Publicly available exploit code exists for this issue, but there is no confirmed active exploitation (CISA KEV) and no evidence of a zero-day; the vendor has released a patch, and this is a moderate, not urgent, priority.
Arbitrary code execution on the Vault host is achievable in HashiCorp Vault and Vault Enterprise when a privileged operator restores a crafted Integrated Storage (Raft) snapshot in a deployment configured with Shamir seals and an external plugin directory, because stored plugin catalog entries are not consistently verified to reference binaries inside that configured directory (CWE-22 path traversal). The attacker must already hold the high privileges needed to restore a Raft snapshot (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), and exploitation also depends on the non-default Shamir-seal-plus-external-plugin-directory configuration, so this is a genuinely serious but condition-gated vulnerability rather than a mass-exploitation threat; clusters using auto-unseal or without an external plugin directory are not affected by this path. No public exploit identified at time of analysis, and vendor-released fixes are available in Vault Community Edition 2.1.2 and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.
Command injection in the OpenSSH ssh client before version 10.6 occurs when a username supplied on the command line contains a '$' or '\' character, which is not correctly escaped or quoted and can be interpreted as shell syntax. The flaw is assessed as CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and requires the victim to invoke ssh with an attacker-controlled username - for example from a crafted ssh:// URI, a shared connection string, or a script or alias - so it is not remotely triggerable against a default server. No public exploit was identified at time of analysis, EPSS is 0.13% (2nd percentile), and the issue does not appear on CISA KEV; this is a genuine but not emergency-grade issue, and patched clients (10.6 and later) are unaffected.
Post-authentication OS command injection in SonicWall SMA1000 firmware (12.5.0-02952 and 12.4.3-03526 platform-hotfixes and older) allows an attacker with administrator credentials to execute arbitrary OS commands, leading to remote code execution. The independent assessment rates this as a moderate priority due to the requirement for valid administrator credentials and undisclosed 'specific conditions'; no public exploit code has been identified at time of analysis. The vendor CVSS vector (AV:L) differs from the assessed network vector, and exploitability may be further limited by configuration-specific factors.
Heap buffer overflow in the glamor acceleration path of the X.Org X server (and Xwayland) allows an authenticated local X client to corrupt the server's heap, with the potential for code execution or a server crash, although reliable exploitation is assessed as high-complexity. The flaw is addressed in the October 2026 X.Org security release, which fixes a bundle of XKB, Present, XInput, GLX and XFixes issues in xorg-server 21.1.25 and xwayland 24.1.14. No public exploit code and no CISA KEV entry were identified at time of analysis; no CVSS vector or EPSS score was supplied for this CVE, and the input itself does not contain a CVE-2026-93523 advisory entry, so the mapping of this identifier to the glamor size-calculation overflow is inferred from an associated upstream commit rather than confirmed by vendor text.
Heap buffer overflow in X.Org X Server before 21.1.15 and XWayland before 24.1.14 allows an authenticated X client to crash the display server or potentially execute code in the X server context by exercising the CopyArea CPU-to-FBO path where a size mismatch overflows a heap buffer. The flaw is CWE-122 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting local, low-complexity access requiring an authenticated X client connection and high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and vendor patches are available in the fixed releases and referenced Red Hat errata.
An integer overflow in the glamor rendering upload path of the X.Org X server (and Xwayland) can produce an undersized heap allocation and subsequent out-of-bounds memory writes, and is one of the issues bundled into the October 2026 X.Org security advisory tracked as CVE-2026-93521. The affected code is in builds of X.Org X server prior to xorg-server-21.1.25 and Xwayland prior to xwayland-24.1.14; exploitation requires an authenticated local X client able to reach a depth-24 drawable uploaded into a depth-32 pixmap while glamor GL acceleration is active, with the byte_stride * height computation in glamor_upload_boxes overflowing before XNFalloc is called. No public exploit code, EPSS score, CWE assignment, or CISA KEV entry was present in the input, so there is no public exploit identified at time of analysis, and because the per-CVE description for CVE-2026-93521 is absent from the truncated advisory these conditions are inferred from the associated commit and should be verified against the vendor's per-CVE entry.
Heap buffer overflow in X.Org X Server before 2.1.25 and XWayland before 24.1.14 allows an authenticated X client to crash the display server or potentially execute code in the X server context. The flaw is a local, low-privilege issue (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N) triggered when XKB ChangeKeycodeRange requests use a keycode range that mismatches XkbAllocNames buffer size calculations. No CISA KEV listing, EPSS score, or public exploit was identified at time of analysis; vendor patches are available.
Heap buffer overflow in X.Org X Server versions prior to 21.1.25 and in Xwayland prior to 24.1.14 stems from an integer truncation inside XkbResizeKeyType(), where the computed key-symbol count is stored in an unsigned short and wraps for sufficiently large nTotal values, yielding an undersized allocation that subsequent writes overflow. The X.Org advisory of October 2026 states the trigger is an X client sending crafted XKB requests that resize a key type with a large nTotal; because no CVSS vector was supplied, authentication requirements are not confirmed from available data, and the advisory's own phrasing describes the actor as an authenticated X client. No CVSS score, EPSS estimate, CISA KEV listing, or public exploit code was available at time of analysis, so no public exploit identified at time of analysis; the vendor assesses the impact as heap corruption that can lead to arbitrary code execution or denial of service. This CVE is one of seven flaws disclosed together in the same X.Org security advisory.
Buffer overflow in X.Org X Server's XFixes extension (and Xwayland) allows an authenticated local X client to trigger a stack or heap overflow by creating more than 100 pointer barriers and generating pointer motion events, potentially leading to arbitrary code execution or denial of service. The flaw, tracked as CVE-2026-93519, affects X.Org X server versions prior to 21.1.25 and Xwayland versions prior to 24.1.14. No public exploit code or active exploitation has been identified at time of analysis; independent assessment assigns a CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
A double free in the X.Org X server's XKB SetGeometry request handler (CVE-2026-88812) lets an authenticated X client that is already able to connect to the target display corrupt heap memory by sending a crafted XkbSetGeometry request containing a malformed TextDoodad entry, with outcomes ranging from a server crash to potential arbitrary code execution. Only builds of xorg-server prior to 21.1.25 and Xwayland prior to 24.1.14 are affected, and the XKB extension required for the trigger is standard and enabled by default. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation presupposes an existing local/same-session X connection rather than remote or unauthenticated access, and no public exploit code, EPSS score, or CISA KEV entry appears in the supplied data, so reliable code execution additionally depends on defeating heap allocator hardening.
Remote code execution on TechDocs build hosts affects Backstage deployments running the @backstage/plugin-techdocs-node mkdocs generator prior to 1.14.6 (and 1.15.x prior to 1.15.4). An authenticated user holding the privilege to register or update catalog entities can commit a crafted mkdocs.yml whose markdown_extensions entries point at dangerous Python callables such as subprocess:Popen, os:system, or plantuml_markdown's plantuml_cmd, which mkdocs instantiates and executes while building the docs; the flaw requires authentication and an entity-registration permission rather than anonymous access, and deployments that publish pre-built docs or build in isolated disposable runners have a much smaller blast radius. The upstream fix, which extends MkDocs configuration sanitization to cover nested configuration keys, hyphenated extension names, and theme options, is available in vendor-released versions 1.14.6 and 1.15.4, and no public exploit code tied to this CVE was identified at time of analysis beyond the payload fixtures included in the upstream fix commit.
Windows logon token reuse in wolfSSHd versions 1.4.15 through 1.5.0 allows an authenticated low-privilege user to impersonate a higher-privileged user by exploiting a failure to release the Windows logon token between authenticated connections. Only the Windows port is affected; non-Windows builds are explicitly unaffected. Exploitation depends on a timing overlap with a privileged user's login (assessed as a race condition, AT:P in CVSS 4.0 and AC:H in the independent CVSS 3.1 assessment), and no public exploit identified at time of analysis. Upstream fix commits are available and the vendor advisory is published; severity is assessed as High (CVSS 4.0 7.7).
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-techdocs-node) lets an authenticated user who can register or modify documentation sources make a TechDocs build read files or fetch URLs outside the documentation boundary, potentially exposing backend-host data or internal network resources (path traversal, CWE-22). Affected versions are those before 1.14.6 on the 1.14 line and before 1.15.4 on the 1.15 line; the impact is changed-scope with high confidentiality loss and no integrity or availability impact, and it applies to deployments where the Backstage backend generates TechDocs from those sources rather than relying on externally sandboxed CI. Exploitation requires an authenticated principal with documentation-source registration or modification rights (PR:L), and no public exploit code has been identified at time of analysis; this is assessed as a credible, patch-worthy issue rather than an emergency, with vendor fixes released in @backstage/plugin-techdocs-node 1.14.6 and 1.15.4 plus pymdown-extensions 10.21.3 or newer.
Command injection in Backstage's TechDocs build pipeline allows an authenticated user who can register or modify a documentation source to run arbitrary commands inside the TechDocs backend or its build container by supplying a crafted mkdocs.yml. Exploitation requires write access to a catalog entity or docs source that is processed by local or docker-based TechDocs generation, and the impact is confined to resources reachable by the backend or its build container; deployments that only publish externally pre-built documentation are not exposed. The issue is fixed in @backstage/plugin-techdocs-node 1.14.6 and 1.15.4, is rated CVSS 7.7 with high attack complexity, low privileges, and scope change, and there is no public exploit identified at time of analysis.
Derivation of IFTTT pairing tokens in the ASUS RT-BE57 router allows an unauthenticated attacker within adjacent wireless range to read or modify router settings, provided they can observe a live administrator-initiated IFTTT pairing exchange. The root cause is a predictable seed in the pairing-token PRNG (CWE-337), which lets the attacker reconstruct the token from values emitted during that session; the assessed CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:H) reflects full impact to router confidentiality, integrity, and availability but heavily conditioned on adjacency, high attack complexity, and a present attack requirement. Exploitation is therefore opportunistic rather than on-demand and only affects deployments where IFTTT integration is actually used; no public exploit code has been identified at time of analysis.
Local privilege escalation in Splunk Enterprise on Linux (versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15) allows an attacker who can already run commands as the OS account running Splunk Enterprise to inject operating-system commands into installation content that a subsequent root-privileged Linux package upgrade will execute as root. The flaw is conditional: the attacker must modify the installation and then a privileged package upgrade must occur, so there is no at-will escalation. No public exploit or confirmed active exploitation was identified at time of analysis.
A time-of-check to time-of-use (TOCTOU) race condition in Anthropic's Claude Code CLI allows an attacker who already has write access to a shared project workspace to atomically replace a project file with a symlink after the agent has validated the path but before it writes, causing Claude Code to follow the link and write to an arbitrary file outside the sandbox - for example a shell configuration file that will later be sourced by a higher-privileged session. Exploitation is bounded: it requires local write access to a workspace shared with a more privileged Claude Code session, requires winning a narrow timing race rather than triggering deterministically, and requires the privileged session to actually perform a write to the targeted path; single-user installations with no shared workspace are not exposed. There is no indication of active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, though Anthropic has already shipped the fix through the standard auto-update channel, leaving only manual-update holdouts at risk.
OS command injection in GitAhead through 2.7.1 lets a malicious repository execute arbitrary shell commands on the victim's machine during a routine checkout or staging operation, because crafted filenames are substituted unescaped into Git clean/smudge filter commands that GitAhead runs through 'bash -c'. The attack is remote and unauthenticated from the attacker's side (CVSS 4.0 vector PR:N) but high in complexity and gated on user interaction: the victim must clone or open an untrusted repository and then perform a checkout or stage, making it a conditional code-execution risk rather than a mass-exploitation event. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though the 7.7 base score and full confidentiality/integrity/availability impact justify prompt attention for anyone using the client with repositories of uncertain provenance.
OS command injection in Rundeck before 6.2.0 allows an authenticated user who holds job-run permission to execute arbitrary commands on Windows target nodes by injecting cmd.exe metacharacters (such as &&, |, >, and ;) into free-text job option values. The flaw is in CLIUtils.quoteWindowsCMDArg, which wraps arguments in single quotes - characters that have no quoting semantics in cmd.exe - so the injected command is interpreted rather than treated as literal text, and it executes with the privileges of the node executor's credentials. Exploitation requires a valid account with job-run authorization, a job that targets Windows nodes through the cmd.exe-based executor, and a job definition that exposes a free-text option passed as a command argument; there is no public exploit identified at time of analysis, and the independent assessment rates this a moderate-priority authenticated RCE rather than a drive-by critical issue.
Sensitive information disclosure in IBM Langflow OSS 1.0.0 through 1.12.2 allows a remote, low-privilege authenticated attacker to retrieve objects belonging to other users by manipulating a user-controlled identifier that the application fails to scope to the requesting principal (CWE-639, IDOR-style authorization bypass). The flaw is network-reachable with low attack complexity and no user interaction, but it is gated on the attacker already holding valid credentials for a low-privilege account (CVSS PR:L); the assessed impact is a high-confidentiality, read-only exposure with no demonstrated integrity or availability effect, so realistic risk concentrates in multi-user or multi-tenant Langflow deployments where a low-trust account can reach another tenant's or user's data. Patch available per vendor advisory (IBM support node 7290694); no public exploit identified at time of analysis.
Authentication bypass in Express Gateway through 1.16.11 (CWE-287) allows an attacker holding any valid registered OAuth 2.0 client credentials and the identifier portion of another user's refresh token to exchange it for that user's access token, impersonating the victim against OAuth2-protected APIs. The flaw is in the refresh_token grant handler, which never validates the refresh token's secret component or confirms that the presenting client is the client the token was issued to, producing high confidentiality and integrity impact with no availability impact (CVSS 4.0 base 7.6). Exploitation requires low-privileged access plus prior knowledge of the victim's token identifier (PR:L, AC:H), making this a targeted impersonation primitive rather than a mass-exploitable bug; no public exploit identified at time of analysis.
Certificate validation in OpenSSL-based OpenVPN builds can be subverted by a peer that presents an X.509 certificate whose subject contains an embedded NULL byte, because subject-name parsing truncates at the NUL and the crafted certificate is then accepted as valid (CVE-2026-84790, CWE-158). Deployments at risk are OpenSSL-linked OpenVPN builds older than v2.7.8 that use certificate-based authentication; mbedTLS builds are not affected because they always rejected such certificates. The independent assessment scores this as CVSS:3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (attack complexity high, some position/privilege assumed, and a purpose-built certificate required), which is consistent with the vendor's CVSS 4.0 score of 7.6 High; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Connection-pool reuse in the AsyncHttpClient (AHC) Java library, versions prior to 3.0.13 and 2.16.1, lets an authenticated principal inherit an HTTP/1.1 socket that was authenticated by a different principal under NTLM, Kerberos, or SPNEGO/Negotiate, causing the backend to execute the second request as the first identity - a full read/act-as impersonation (VC:H/VI:H). The flaw is that the connection-pool partition key omits the authenticated principal for connection-oriented authentication schemes, while Basic and Digest, which authenticate every request, are not affected. Exploitation requires an authenticated user (PR:L) on a deployment that shares one client/pool across multiple identities, and it is timing-dependent (AC:H, AT:P) because a suitably authenticated pooled socket must exist and be handed to the mismatched request; no public exploit code was identified at time of analysis and there is no KEV entry, though EPSS data was not provided. The vendor-released patch is AsyncHttpClient 3.0.13 (3.x line) or 2.16.1 (2.x line).
Authenticated information disclosure in Splunk Enterprise allows a low-privileged account to bypass an intended security control and access data it should not be able to reach, affecting versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. Rated CVSS 7.6 (AV:N/AC:L/PR:L/UI:N, with high confidentiality impact but only low integrity and availability impact), the issue is classified as CWE-693, Protection Mechanism Failure, and requires only a valid Splunk account with network reachability to the instance - no user interaction is needed, but a fully unauthenticated outsider cannot exploit it. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the vendor has released fixed builds for all four affected release trains for this internally discovered flaw.