Unauthorized remote code execution is possible in Microsoft Dataverse through deserialization of untrusted data, scored 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:N and UI:N, the vulnerable deserialization path can be reached by remote attackers without authentication, user interaction, or special configuration. No public exploit code has been identified at time of analysis (E:U) and there is no confirmed active exploitation; the principal constraint on real-world risk is that Dataverse is a Microsoft-operated cloud service, so the official fix (RL:O) is applied server-side by Microsoft and exposure is largely bounded to the pre-patch window.
Unauthenticated arbitrary file upload in the Bricksforge plugin for WordPress (all versions up to and including 3.1.8.9) lets a remote attacker plant a PHP payload in the upload directory and execute it, resulting in complete compromise of the affected WordPress site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack chain abuses the plugin's public 'bricksforge_regenerate_nonce' AJAX endpoint to obtain a valid nonce without credentials, uploads a GIF/PHP polyglot through the temporary file-upload path where MIME checks are actually performed, then re-submits a form whose 'temporaryFileUploads' parameter points at the already-validated file while the attacker-controlled 'url' field forces a .php extension on the final write. No authentication, interaction, or non-default configuration is required beyond an installed and active vulnerable plugin on a server that executes PHP from the upload location; no public exploit code was identified at time of analysis.
Unauthenticated remote OS command injection in the login.xgi CGI endpoint of Iskratel Innbox GPON ONT devices lets any attacker who can reach the device's web management interface run arbitrary operating-system commands with root privileges by supplying shell metacharacters through the CLI parameter. Rated CVSS 9.3 (CVSS 4.0) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the flaw requires no authentication, no user interaction, and no non-default configuration, giving a full compromise of the device's confidentiality, integrity, and availability. Publicly available exploit code exists in the form of a GitHub proof-of-concept that lands a root shell, so exploitation is straightforward for anyone with network reachability; no CISA KEV entry or confirmed in-the-wild exploitation was present in the available data, and the practical limiting factor is exposure - devices whose management plane is confined to the ISP access network or an isolated LAN are protected by segmentation rather than by any authentication control.
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated attacker forge valid HS256 JWTs using the service's own RSA public key, because non-whitespace bytes ahead of the PEM header cause the library to misclassify the public key as an HMAC shared secret. Exploitation is not trivial and depends on two preconditions being met at once: the verifier must load the asymmetric key from a source that left content such as a '#' or '//' comment line, an HTTP-style header, a PGP/text wrapper, or control or zero-width Unicode (NUL, ESC, U+200B, U+200D, U+FEFF) before '-----BEGIN PUBLIC KEY-----', and the verifier must infer or allow HS256 rather than enforcing an asymmetric-only algorithm allowlist; clean PEM keys and asymmetric-only configurations are not affected. Publicly available exploit code exists (a working PoC is included in the vendor GHSA advisory), no CISA KEV listing or active exploitation is indicated, and the supplied 9.8 CVSS overstates real-world exploitability - the independently assessed vector is AV:N/AC:H/PR:N/UI:N with no availability impact, consistent with the two hard preconditions above.
Unauthenticated password reset bypass in Integrics Enswitch 3.13 through 4.4 allows remote attackers to change passwords for accounts that have no pending reset by omitting the reset parameter, causing the empty reset_key to match the defaulted empty value; this enables administrator account takeover after enumerating valid usernames. Publicly available exploit code exists, and the vulnerability is remotely exploitable without authentication or user interaction, making it a genuine high-priority issue.
Authorization bypass in the Hazelcast IMap Predicates API allows a client holding only limited cluster credentials to execute arbitrary code on a Hazelcast cluster member in versions prior to 5.4.5, 5.5.10, 5.6.1 and 5.7.0. Because the missing check sits inside the map permission model itself, a partially trusted client - for instance one granted read or put rights on a single map - can invoke the aggregation and projection query paths that were never gated by a permission bit, yielding full compromise of confidentiality, integrity and availability on the member (CVSS 4.0 base 8.7 High; vendor-assessed CVSS 3.1 8.7 with PR:L). Exploitation requires an authenticated client connection to the cluster, so it is not reachable by fully unauthenticated attackers; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor states no workaround exists other than upgrading.
Intego Antivirus for Windows through 3.0.0.1 permits a local unprivileged user to escalate to SYSTEM by exploiting a link-following flaw (CWE-59) in its optimization module. A scanned duplicate file's directory can be replaced with an NTFS junction to C:\Config.msi, allowing arbitrary folder deletion with SYSTEM rights and abuse of Windows Installer rollback to execute code as SYSTEM. Publicly available exploit code exists, but exploitation requires a pre-existing low-privileged interactive Windows account and use of the optimization/duplicate-scan module; this is a credible but bounded local privilege-escalation risk rather than a mass-exploitation emergency.
Local privilege escalation in Deskin 3.3.4.3 and earlier on macOS allows any local unprivileged process to gain full root by connecting to the root-owned com.deskin.service.installer XPC service, which performs no client authentication, and invoking its privileged installer method with an attacker-supplied installer package. Because the flaw (CWE-306) sits on a local Mach/IPC path, an attacker must already hold a local account or code-execution foothold on a host where Deskin is installed and the installer service is running, making it a post-compromise escalation primitive rather than an initial access vector. Publicly available exploit code exists (GitHub PoC, reported via VulnCheck) but there is no confirmed active exploitation (CISA KEV) at time of analysis; the submitted CVSS 4.0 score of 8.5 and the independently assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) both reflect high confidentiality, integrity and availability impact once the local prerequisite is satisfied.
EspoCRM deployments before 10.0.5 allow an authenticated user with Email Account scope to retrieve other users' stored IMAP passwords via an insecure direct object reference in PersonalAccount\Service, enabling mailbox compromise. Attackers must know or enumerate a victim's Email Account record ID, and publicly available exploit code exists; there is no confirmation of active exploitation (CISA KEV) at time of analysis. The vulnerability is a confidentiality-only issue with changed scope, rated high risk because it exposes reusable credentials.
Signed JSON Web Tokens whose payload is a JSON array silently bypass every configured claim validator in the npm package fast-jwt through version 6.2.4, so the verifier returns success while enforcing only the signature and skipping exp, nbf, iss, aud, sub, jti and nonce checks. The flaw is exploitable by an authenticated attacker (CVSS PR:L) who can produce or influence a validly-signed token - signature verification itself is not broken, so the attacker must have access to the signing key or to a token-issuance path that lets them control the payload structure - and the true risk is gated by that precondition and by AC:H rather than the raw 8.1 base score. Publicly available exploit code exists in the vendor advisory, but there is no confirmed active exploitation (not in CISA KEV) and exploitation is blocked entirely in deployments that enable the opt-in requiredClaims option or that have upgraded to 6.3.0.
Processing an attacker-controlled Protobuf schema with datamodel-code-generator 0.59.0 through 0.80.0 lets a crafted weak-import path escape the `__weak_imports__` temporary directory, creating directory trees and new files, or overwriting existing files that are writable by the running process (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N; the vendor-reported vector is 7.5 with a higher integrity rating). Exploitation requires a victim or automated CI job to invoke the tool with `--input-file-type protobuf` on a malicious .proto supplied locally via `--input` or remotely via `--url`, and the grpcio-tools package must be installed to enable Protobuf input support; the payload is limited to a `syntax = "proto2";` or `syntax = "proto3";` declaration, so fully attacker-controlled content and direct arbitrary code execution have not been demonstrated. No active exploitation is confirmed (not in CISA KEV), though the upstream GitHub advisory carries a proof-of-concept and technical write-up, and the fix ships in version 0.81.0.
Remote code execution or denial of service in NetScaler ADC and NetScaler Gateway (CVSS 9.5) via a memory overflow when configured as a SAML Service Provider or Identity Provider. Affected versions include 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 (and FIPS/NDcPP equivalents) when acting as SAML IdP, as well as all earlier versions when acting as either SP or IdP. No authentication is required (PR:N) and no public exploit has been identified at time of analysis, though the high attack complexity (AC:H) may limit reliable exploitation.
Strawberry GraphQL versions 0.217.0 through 0.326.0 contain an authorization bypass in which a custom permission class whose has_permission() is declared as a synchronous def but returns an awaitable (for example a coroutine) can grant access to fields that should be denied. Because only async def methods are detected as asynchronous, the returned awaitable is evaluated for truthiness on the synchronous resolve path and is always truthy, so the protected resolver runs even when the awaitable would resolve to False. The flaw affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def or returning a plain boolean are unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis, though the patch is a single small commit (PR #4605) that is easy to reverse-engineer.
Denial of service through CPU exhaustion in Go's HTTP/2 implementation (net/http and golang.org/x/net) lets an unauthenticated remote HTTP/2 peer open many streams and then repeatedly send small SETTINGS frames carrying SETTINGS_INITIAL_WINDOW_SIZE, forcing the victim to recompute per-stream flow-control window state at O(number of streams) for each frame (assessed CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability - there is no confidentiality or integrity loss - and exposure is limited to Go programs with HTTP/2 active: servers over TLS (the Go default) and Go HTTP/2 clients connecting to an attacker-controlled peer, in versions predating the O(1) initial-window-size fix tracked in Go issue 81742. No public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); HTTP/1-only deployments are unaffected.
Memory exhaustion in Go's standard-library net/http HTTP/2 server lets a remote attacker send a single crafted request whose "Trailer" header declares an excessive number of fields, causing the server to allocate a disproportionately large Request.Trailer map for the handler. The issue is availability-only (C:N/I:N/A:H), requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and crucially bypasses the Server.MaxHeaderValueCount and Server.MaxHeaderBytes defenses; HTTP/1 servers are not affected because they do not multiplex many requests over one connection and account for MaxHeaderBytes differently. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.23% (12th percentile), and vendor patches are available, so this is a genuine but moderate-priority availability bug rather than an emergency.
Concurrent mutation of the shared HPACK encoder in Go's HTTP/2 server stack (net/http, also reachable via golang.org/x/net/http2, tracked as GO-2026-6617) allows remote, unauthenticated attackers to crash the process by repeatedly issuing requests while sending SETTINGS frames that change SETTINGS_HEADER_TABLE_SIZE. One goroutine encodes a HEADERS frame for an outgoing response while another resizes the encoder's dynamic table with no synchronization, producing a data race (CWE-362) that can terminate the server. The impact is availability only (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H); exploitation is timing-dependent and requires HTTP/2 to be enabled, but publicly available exploit code exists and EPSS is low at roughly 0.18% (7th percentile). There is no confirmed active exploitation (CISA KEV does not list this CVE), and a vendor patch is available per vendor advisory.
Authentication and authorization bypass in fast-jwt 6.3.0 and earlier lets a remote, unauthenticated attacker submit a forged unsigned JWT containing arbitrary claims and have it accepted without possessing any signing key. The defect is reachable only when an application instantiates createVerifier with a falsy synchronous key (an empty string '' or null) while also supplying a non-empty algorithms allowlist such as ['HS256']; that combination causes prepareKeyOrSecret to be skipped, hasKey to evaluate false, and the empty signature segment of an unsigned token to bypass the verifySignature gate entirely. The issue is fixed in 6.3.1, and no public exploit code was identified at time of analysis - the primary real-world limiter is that the vulnerable configuration is non-default and developer-introduced, though once such a verifier exists no privileges or user interaction are required of the attacker.
Infinite loop in FFmpeg's HLS demuxer (libavformat/hls.c) lets remote attackers pin CPU and I/O indefinitely on any host that feeds a crafted playlist to FFmpeg before version 8.1.3. A malicious Media Playlist that embeds Master Playlist tags causes parse_playlist()/hls_read_header() to keep registering self-referencing variants that never terminate. Exploitation is unauthenticated (PR:N) but requires a victim or automated pipeline to open the playlist (UI:P), impact is availability-only with no data disclosure or code execution, and publicly available exploit code exists; there is no confirmed active exploitation (CISA KEV) at time of analysis.
FFmpeg through 9.0.2 contains an infinite loop in ff_rtsp_connect() (libavformat/rtsp.c) because the RTSP client follows 3xx redirects without a redirect limit, allowing a malicious RTSP server to cause endless reconnects that saturate a CPU core. Exploitation is remote and unauthenticated (CVSS PR:N) but requires passive user interaction (UI:P/UI:R): the victim must open an RTSP stream that resolves to the attacker-controlled server, which then answers every request with a 302 redirect to itself or another server. Publicly available exploit code exists (a gist PoC), but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a genuine but bounded availability threat, with the highest exposure in services that accept and open user-supplied RTSP URLs automatically.
Improper certificate validation in Microsoft Partner Center allows a network-positioned attacker to impersonate the service and gain elevated privileges, with a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) though exploit maturity is unproven (E:U). Exploitation requires the attacker to intercept, relay, or inject into the TLS path and present a certificate the service wrongly accepts (CWE-295); no authentication or user interaction is needed, and no public exploit code has been identified. As a Microsoft-hosted cloud service, the fix is deployed centrally by Microsoft.
Authorization bypass in Microsoft Bookings allows unauthenticated remote attackers to elevate privileges by manipulating user-controlled keys. The flaw, tracked as CVE-2026-94510, stems from an insecure direct object reference (CWE-639) and carries a CVSS 3.1 base score of 9.9 due to scope change and high integrity impact. No public exploit code is known to be circulating, and Microsoft has applied a server-side patch to the hosted service.
Cross-origin credential leakage in the Mechanize Ruby library (versions prior to 2.14.1) allows attackers who control a redirect target to capture bearer tokens, session cookies, Proxy-Authorization credentials, or Cookie2 values that the calling application supplied through Mechanize#request_headers= or the per-request headers argument. The flaw is conditional: it only triggers when an application actually sets credentials via those header APIs and a response issues a cross-origin HTTP redirect (or a cross-origin meta refresh), so same-origin redirects are unaffected and credentials managed through Mechanize#cookie_jar or Mechanize::HTTP::AuthStore are explicitly out of scope; there is no public exploit identified at time of analysis. Because the attacker must influence the redirect destination rather than merely reach the service, this is a genuine but conditional information-disclosure issue (CWE-200) rather than a mass-exploitation priority.
Credential leakage in the Ruby Mechanize library before 2.14.1 lets an attacker who controls page content encountered during a crawl capture bearer tokens or session cookies, because a cross-origin meta refresh caused Mechanize::HTTP::Agent#response_follow_meta_refresh to reapply the caller's global default headers to the refresh request. Exploitation is conditional and rated AC:H: Mechanize#follow_meta_refresh must be explicitly enabled (it defaults to false), the caller must have placed sensitive credentials in the agent-wide default headers via Mechanize#request_headers=, and the attacker must be able to serve attacker-controlled markup to the crawl, though the request itself is unauthenticated (PR:N) and requires no user interaction (UI:N). There is no KEV entry, no public exploit identified at time of analysis, and no EPSS score supplied; the vendor-released fix is Mechanize 2.14.1, where cross-origin meta refreshes now discard credential and cookie headers under the same origin rules as HTTP redirects.
Relative path traversal in Satel Netco Design versions prior to v2.1.7 lets an authenticated user holding only Viewer privileges write attacker-influenced files to any filesystem location reachable by the application service account, which can escalate to arbitrary code execution where a writable location is later executed or loaded by the service. The flaw affects the product's data export functionality (CWE-23) and is remotely reachable over the network, but requires a valid low-privileged account (CVSS 3.1 vector PR:L), so anonymous access is not sufficient. Rated 8.7 under CVSS 4.0 and reported through CISA ICS-CERT advisory ICSA-26-281-03; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. The full RCE outcome is conditional on deployment-specific file-write-then-execute paths; absent those, impact is confined to unauthorized file creation or modification within application-accessible directories.
Stored cross-site scripting in Satel Netco Design versions prior to v2.1.7 allows an authenticated user with Network Operator privileges to persist untrusted content that the application later renders without adequate neutralization, causing script execution in another user's browser when that content is viewed. Exploitation is a two-step chain: an attacker must already hold or compromise a privileged Network Operator account to plant the payload, and a separate user must subsequently open the affected page for the script to fire (CVSS 4.0 base 8.5 High; the independent assessment scores it CVSS 3.1 with scope change but only low confidentiality and integrity impact and no availability impact). No public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the fix is to upgrade to v2.1.7 per the vendor advisory published through CISA ICS (ICSA-26-281-03).
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victim's balance in the Wallet System for WooCommerce plugin (versions before 2.8.0) by exploiting a failure to validate positive transfer amounts and a stale balance snapshot. Publicly available exploit code exists, and the flaw rates 6.5 on CVSS with high integrity impact but no confidentiality or availability impact. Sites with real monetary value in wallets are at risk, though exploitation requires an attacker account (obtainable via open registration).
Missing output encoding in AdonisJS HTTP Server's shared createURL() helper allows an attacker-influenced first route parameter (or wildcard segment) to escape the application's origin and produce a scheme-relative redirect target, enabling open-redirect phishing and OAuth/authentication flow abuse. Only applications running versions prior to 8.2.3 (v8 line) or 9.3.0 (v9 line) are affected, and exploitation is conditional: the app must place untrusted data in a leading dynamic path segment, generate the URL through Router.makeUrl()/urlFor() or Response.redirect().toRoute(), and use that string as a redirect destination - a victim still has to follow the crafted link (UI:R, CVSS 6.1). No public exploit code and no confirmed active exploitation were identified at time of analysis, and APIs that intentionally accept complete redirect URLs are explicitly not affected.
Unauthenticated blind SQL injection in the NetBoard CRM demo platform lets remote attackers read and modify backend database contents by sending a crafted POST request to the password-recovery endpoint /module/auth/recovery.php, where the 'user-name' parameter is passed unsafely into a SQL query. The flaw carries a maximum-severity CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L), so no credentials, user interaction, or non-default configuration are needed; the practical limiting factor is whether an instance of this specific demo application is reachable from the internet, since it is a demonstration platform rather than a widely deployed production CRM. No public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score was supplied, so active exploitation is not confirmed; exploitation is demonstrated through Boolean, error-based, time-based, and UNION query techniques.
fast-jwt through 6.2.4 silently accepts expired and not-yet-active JSON Web Tokens when a verifier is constructed with clockTolerance set to Infinity, because the option validation only checks that the value is a number and non-negative rather than finite. The precondition is privileged and non-default: an application administrator or anyone controlling the verifier's configuration must explicitly set that value, which is why the assessed vector carries PR:H and the score remains moderate at 5.9; default configurations are unaffected. A secondary effect is that the verifier's internal LRU cache derives infinite validity bounds, so cached decisions made under the misconfiguration persist even after the Infinity setting is removed, until cache eviction. No active exploitation is recorded (not in CISA KEV), but publicly available exploit code exists in the upstream advisory, which demonstrates both the exp and nbf bypass empirically.
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers to execute arbitrary code on the affected deployment, producing a vendor CVSS 3.1 base score of 9.8 from the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Per that vector the flaw requires no authentication, no user interaction, and no non-default configuration, so the only practical barrier is network reachability of the exposed Guardium interface; because the product is normally deployed inside segmented enterprise networks, internet-wide exposure is expected to be limited. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the worst-case skill and access profile place this in the urgent patching tier for any instance reachable from untrusted networks; the specific traversal entry point and the path from traversal to code execution are not detailed in the available advisory data and should be confirmed against IBM support node 7291674.
Unauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 - including their containerized editions - through deserialization of untrusted data, allowing an attacker who can reach the affected service to run arbitrary code on the system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms the flaw is network-reachable and requires no authentication, privileges, or user interaction, so any exposed, unpatched instance should be considered directly exploitable; the only real gating factors are running an affected build and whether the vulnerable endpoint is network-accessible. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the pre-authentication nature of the issue places it in the highest remediation priority tier.
Unauthenticated remote code execution affects IBM DataPower Gateway across multiple release streams - 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 - stemming from an out-of-bounds write (CWE-787) that corrupts memory and can be leveraged to run attacker-controlled code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the flaw is reachable over the network with no authentication and no user interaction, making any internet- or partner-facing DataPower instance running an unpatched build a high-priority target. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; patch available per vendor advisory (IBM support page node/7289775), with the specific fixed firmware builds published there.
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, because the affected services deserialize untrusted data received over the network. The flaw is reachable without authentication and without user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), allowing an attacker who can reach the vulnerable endpoint to run arbitrary code with the privileges of the affected process. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but a vendor patch is available and the only practical barrier to exploitation is network reachability of the exposed service.
Unauthenticated remote code execution is possible in Microsoft Azure App Service for Linux because a critical function is exposed without any authentication check (CWE-306). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), an unauthorized attacker can reach the vulnerable functionality over the network and trigger code execution with no credentials, no user interaction, and low attack complexity, yielding high confidentiality, integrity, and availability impact (CVSS 9.8). Microsoft has published an official fix through its MSRC update guide, and no public exploit code has been identified at time of analysis; the residual risk is concentrated on internet-reachable instances still running an unpatched version. The exact function or endpoint involved is not disclosed in the available data, so operators should treat any network-exposed Azure App Service for Linux deployment as potentially affected until patched or confirmed otherwise.
Remote, unauthenticated code execution is possible in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, because an out-of-bounds write in the RFC2047 encoded-word parser can corrupt memory and be leveraged to run arbitrary code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) indicates the flaw is network-reachable with low complexity, requires no credentials and no user interaction, and carries full confidentiality, integrity, and availability impact, though exploitation depends on a reachable service or flow that passes attacker-controlled data through MIME encoded-word decoding. According to available intelligence there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the primary source is IBM's advisory at https://www.ibm.com/support/pages/node/7289775.
Unauthenticated remote code execution in IBM DataPower Gateway affects the 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 release trains, where a heap-based buffer overflow caused by improper bounds checking lets an attacker who can reach the appliance's request-processing path corrupt heap memory and run arbitrary code with full confidentiality, integrity and availability impact. The flaw is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required, and it is exploitable over the network. There is no public exploit identified at time of analysis and it is not confirmed actively exploited (no CISA KEV listing); IBM has published a vendor fix, and this is a genuine high-priority issue rather than an inflated high-CVSS score.
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthenticated remote attackers to invoke arbitrary management operations against the affected appliance, with the highest possible impact to confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Because the CVSS vector specifies PR:N with no user interaction and no non-default configuration prerequisite, any network-reachable management interface or API endpoint on an affected version is potentially exploitable without credentials; the practical constraint is reachability, since Guardium management planes are typically confined to internal or dedicated management segments. At time of analysis there is no CISA KEV entry and no publicly available exploit code identified, so exploitation is assessed as technically straightforward but not yet observed in external telemetry.
Arbitrary code execution in IBM DataPower Gateway is possible when a user with existing local access to the appliance supplies crafted oversized input to a component that performs improper bounds checking, allowing an out-of-bounds write and, potentially, execution of arbitrary code in the appliance's process context. Affected release trains are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; IBM has published a vendor fix, and no public exploit code was identified at time of analysis. Note that the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) characterizes this as remotely exploitable without privileges, which is inconsistent with the description's requirement for a local user and with the independent assessment of AV:L/AC:L/PR:L/UI:N - the local-access prerequisite is the practical limiter on real-world risk, while the impact if triggered remains full confidentiality, integrity, and availability loss.
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to push and execute arbitrary container images, which in turn grants control over the managed edge clusters that component orchestrates. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for the base case and was independently assessed with scope-changed impact (S:C), reflecting that compromise of the controller extends to the clusters it manages; no credentials, privileges, or user interaction are required against a reachable instance. No public exploit code has been identified at the time of analysis and the issue has not been confirmed as actively exploited (CISA KEV), so the practical risk is driven by network exposure of the edge-controller interface rather than by an observed campaign; a vendor patch is available from IBM.
Empty-password LDAP authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers obtain administrative access to affected appliances by submitting a blank password that the LDAP authentication logic fails to reject. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; exploitation requires only that LDAP be configured for administrative/management authentication and that the authentication interface be network-reachable. At time of analysis there is no public exploit identified, but IBM has published a vendor fix, and the combination of network-only attack surface, no authentication prerequisite, and full confidentiality/integrity/availability impact warrants emergency-level prioritization in any environment using LDAP-backed management logins.
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an unauthenticated remote attacker to crash the agent or potentially execute arbitrary code by sending crafted TDS login fragments that overflow the fixed-size reassembly buffer. Affected deployments are Guardium Data Protection (S-TAP agent) versions 12.0 and 12.1, with EUVD additionally listing 12.2; exploitation requires the S-TAP agent to be actively inspecting TDS traffic on a reachable database-communication path, so exposure is limited to networks where an attacker can inject traffic into monitored Microsoft SQL Server or Sybase/SAP ASE sessions. The vendor rates this CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is enabled by a buffer overflow that an unauthenticated network attacker can trigger without user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8, giving total loss of confidentiality, integrity, and availability on a successful exploit. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation with non-automatable attack steps, and EPSS places exploitation likelihood at 0.37% (29th percentile), so signals are mixed and point to a credible-but-not-yet-urgent priority. The practical limiting factor is network reachability: Guardium is typically deployed as an internal database-activity-monitoring appliance, so an attacker generally needs a foothold on, or routing into, the management or database-monitoring network rather than open internet access.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is possible through a stack-based buffer overflow (CWE-121) in reachable product code, with the vendor CVSS vector indicating a network-accessible, unauthenticated trigger and no required user interaction (AV:N/PR:N/UI:N) and a maximum impact rating of 9.8. Our independent assessment scores the same impact but raises attack complexity to High (AC:H), reflecting that reliable code execution likely requires an attacker to defeat standard memory protections such as stack canaries, ASLR, and DEP, and CISA's SSVC framework rates the issue non-automatable with no observed exploitation; no public exploit identified at time of analysis, and EPSS is low at 0.37% (29th percentile). The practical picture is a high-severity, patch-priority issue rather than an emergency: the vulnerable code is assumed reachable in standard deployments since the advisory names no special prerequisite, but exposure is confined to environments running the three named 12.x releases and the vendor fix closes the window once applied.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated network attackers to trigger a buffer overflow and execute arbitrary code, with total confidentiality, integrity, and availability impact as assessed by CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; EPSS is low (0.37%, 29th percentile), and CISA SSVC marks the attack as not automatable, meaning exploitation would likely require target-specific effort. A vendor patch is available per IBM advisory node/7291674.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is achievable by an unauthenticated remote attacker (CVSS PR:N, UI:N) through a buffer overflow that corrupts memory in a way that can be leveraged to run arbitrary code, yielding high confidentiality, integrity, and availability impact (CVSS 8.1). Attack complexity is High (AC:H), so reliable exploitation depends on conditions outside the attacker's control - such as precise memory layout, timing, or a specific non-trivial input path - which tempers the practical risk despite the elevated base score. Only the listed 12.x branches are affected and patched builds are not exploitable; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
Remote, unauthenticated memory corruption in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows an attacker who can reach a monitored MongoDB data path to overflow a heap buffer in the product's MongoDB protocol parser and potentially crash the appliance or execute arbitrary code. The flaw is triggered by a MongoDB SCRAM authentication message carrying an oversized username field, and because the parser runs inside the inspection engine, exposure is limited to deployments where Guardium's S-TAP/collector is actively inspecting MongoDB traffic. The vendor-rated CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a pre-authentication, low-complexity flaw with full confidentiality, integrity, and availability impact, though no public exploit code has been identified at time of analysis and reliable code execution (as opposed to a denial-of-service crash) is constrained by heap-exploitation difficulty.
Remote code execution in IBM DataPower Gateway (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2) is caused by a heap-based buffer overflow that a remote attacker can trigger without authentication or user interaction, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) with total impact to confidentiality, integrity, and availability. Exploitation is not confirmed by any signal: no public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, SSVC reports Exploitation=none with Automatable=no, and EPSS is only 0.37% (29th percentile). The practical risk therefore hinges on whether affected DataPower builds are reachable from untrusted networks, since IBM has published a fix and the high base score reflects worst-case impact rather than observed attack activity.
OS command injection in IBM Guardium Data Protection 12.2.2 and 12.1 lets a remote attacker execute arbitrary operating-system commands with the privileges of the vulnerable service, yielding a full compromise of confidentiality, integrity, and availability (CVSS 9.8, CWE-78). The CVSS vector rates the flaw as unauthenticated (PR:N) over the network (AV:N) with no user interaction, although IBM's own text does not confirm whether a valid console or API session is needed to reach the vulnerable command path, and the practical risk is narrowed by the fact that Guardium appliances are normally deployed on internal management networks rather than being internet-facing. As of analysis, there is no public exploit code identified, EPSS is low at 0.36% (28th percentile), CISA SSVC records Exploitation: none with Automatable: no, and there is no KEV listing, so the dominant driver of urgency is the severity of impact if an attacker does obtain a path to the interface rather than observed exploitation.
Crafted TDS PRELOGIN packets traversing a network segment monitored by an IBM Guardium Data Protection 12.0, 12.1, or 12.2 Collector trigger a buffer overrun in the appliance's Microsoft SQL Server protocol decoder, reliably causing denial of service and, per the vendor, potentially allowing arbitrary code execution on the Collector itself. Exploitation is unauthenticated (CVSS vector PR:N) and requires no user interaction, but it depends on the attacker's ability to place a malformed packet onto the monitored database network rather than reaching a directly addressable service, because the Collector inspects traffic passively. No public exploit code has been identified at time of analysis and EPSS is low at 0.36% (28th percentile); IBM has published a vendor fix, and CISA's SSVC assessment records no observed exploitation.
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute unauthorized SQL statements against the appliance, with the vendor-assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating full compromise of confidentiality, integrity, and availability of the affected component with no privileges or user interaction required. The vulnerable feature or endpoint is not publicly disclosed, so defenders cannot pin down a specific setting to harden, but the practical gating factor is reachability: Guardium is a data-security management appliance that normally sits on an internal or management network segment rather than the public internet. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but a vendor patch is available and should be treated as high priority because of the 9.8 severity and the sensitivity of the data Guardium manages.