Unauthorized remote code execution is possible in Microsoft Dataverse through deserialization of untrusted data, scored 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:N and UI:N, the vulnerable deserialization path can be reached by remote attackers without authentication, user interaction, or special configuration. No public exploit code has been identified at time of analysis (E:U) and there is no confirmed active exploitation; the principal constraint on real-world risk is that Dataverse is a Microsoft-operated cloud service, so the official fix (RL:O) is applied server-side by Microsoft and exposure is largely bounded to the pre-patch window.
Unauthenticated arbitrary file upload in the Bricksforge plugin for WordPress (all versions up to and including 3.1.8.9) lets a remote attacker plant a PHP payload in the upload directory and execute it, resulting in complete compromise of the affected WordPress site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack chain abuses the plugin's public 'bricksforge_regenerate_nonce' AJAX endpoint to obtain a valid nonce without credentials, uploads a GIF/PHP polyglot through the temporary file-upload path where MIME checks are actually performed, then re-submits a form whose 'temporaryFileUploads' parameter points at the already-validated file while the attacker-controlled 'url' field forces a .php extension on the final write. No authentication, interaction, or non-default configuration is required beyond an installed and active vulnerable plugin on a server that executes PHP from the upload location; no public exploit code was identified at time of analysis.
Unauthenticated remote OS command injection in the login.xgi CGI endpoint of Iskratel Innbox GPON ONT devices lets any attacker who can reach the device's web management interface run arbitrary operating-system commands with root privileges by supplying shell metacharacters through the CLI parameter. Rated CVSS 9.3 (CVSS 4.0) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the flaw requires no authentication, no user interaction, and no non-default configuration, giving a full compromise of the device's confidentiality, integrity, and availability. Publicly available exploit code exists in the form of a GitHub proof-of-concept that lands a root shell, so exploitation is straightforward for anyone with network reachability; no CISA KEV entry or confirmed in-the-wild exploitation was present in the available data, and the practical limiting factor is exposure - devices whose management plane is confined to the ISP access network or an isolated LAN are protected by segmentation rather than by any authentication control.
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated attacker forge valid HS256 JWTs using the service's own RSA public key, because non-whitespace bytes ahead of the PEM header cause the library to misclassify the public key as an HMAC shared secret. Exploitation is not trivial and depends on two preconditions being met at once: the verifier must load the asymmetric key from a source that left content such as a '#' or '//' comment line, an HTTP-style header, a PGP/text wrapper, or control or zero-width Unicode (NUL, ESC, U+200B, U+200D, U+FEFF) before '-----BEGIN PUBLIC KEY-----', and the verifier must infer or allow HS256 rather than enforcing an asymmetric-only algorithm allowlist; clean PEM keys and asymmetric-only configurations are not affected. Publicly available exploit code exists (a working PoC is included in the vendor GHSA advisory), no CISA KEV listing or active exploitation is indicated, and the supplied 9.8 CVSS overstates real-world exploitability - the independently assessed vector is AV:N/AC:H/PR:N/UI:N with no availability impact, consistent with the two hard preconditions above.
Unauthenticated password reset bypass in Integrics Enswitch 3.13 through 4.4 allows remote attackers to change passwords for accounts that have no pending reset by omitting the reset parameter, causing the empty reset_key to match the defaulted empty value; this enables administrator account takeover after enumerating valid usernames. Publicly available exploit code exists, and the vulnerability is remotely exploitable without authentication or user interaction, making it a genuine high-priority issue.
Remote code execution or denial of service in NetScaler ADC and NetScaler Gateway (CVSS 9.5) via a memory overflow when configured as a SAML Service Provider or Identity Provider. Affected versions include 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 (and FIPS/NDcPP equivalents) when acting as SAML IdP, as well as all earlier versions when acting as either SP or IdP. No authentication is required (PR:N) and no public exploit has been identified at time of analysis, though the high attack complexity (AC:H) may limit reliable exploitation.
Improper certificate validation in Microsoft Partner Center allows a network-positioned attacker to impersonate the service and gain elevated privileges, with a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) though exploit maturity is unproven (E:U). Exploitation requires the attacker to intercept, relay, or inject into the TLS path and present a certificate the service wrongly accepts (CWE-295); no authentication or user interaction is needed, and no public exploit code has been identified. As a Microsoft-hosted cloud service, the fix is deployed centrally by Microsoft.
Authorization bypass in Microsoft Bookings allows unauthenticated remote attackers to elevate privileges by manipulating user-controlled keys. The flaw, tracked as CVE-2026-94510, stems from an insecure direct object reference (CWE-639) and carries a CVSS 3.1 base score of 9.9 due to scope change and high integrity impact. No public exploit code is known to be circulating, and Microsoft has applied a server-side patch to the hosted service.
Unauthenticated blind SQL injection in the NetBoard CRM demo platform lets remote attackers read and modify backend database contents by sending a crafted POST request to the password-recovery endpoint /module/auth/recovery.php, where the 'user-name' parameter is passed unsafely into a SQL query. The flaw carries a maximum-severity CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L), so no credentials, user interaction, or non-default configuration are needed; the practical limiting factor is whether an instance of this specific demo application is reachable from the internet, since it is a demonstration platform rather than a widely deployed production CRM. No public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score was supplied, so active exploitation is not confirmed; exploitation is demonstrated through Boolean, error-based, time-based, and UNION query techniques.
Unauthenticated path traversal in IBM Guardium Data Protection 12.0, 12.1, and 12.2 can be leveraged by remote attackers to execute arbitrary code on the affected deployment, producing a vendor CVSS 3.1 base score of 9.8 from the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Per that vector the flaw requires no authentication, no user interaction, and no non-default configuration, so the only practical barrier is network reachability of the exposed Guardium interface; because the product is normally deployed inside segmented enterprise networks, internet-wide exposure is expected to be limited. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the worst-case skill and access profile place this in the urgent patching tier for any instance reachable from untrusted networks; the specific traversal entry point and the path from traversal to code execution are not detailed in the available advisory data and should be confirmed against IBM support node 7291674.
Unauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 - including their containerized editions - through deserialization of untrusted data, allowing an attacker who can reach the affected service to run arbitrary code on the system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) confirms the flaw is network-reachable and requires no authentication, privileges, or user interaction, so any exposed, unpatched instance should be considered directly exploitable; the only real gating factors are running an affected build and whether the vulnerable endpoint is network-accessible. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a vendor patch is available and the pre-authentication nature of the issue places it in the highest remediation priority tier.
Unauthenticated remote code execution affects IBM DataPower Gateway across multiple release streams - 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 - stemming from an out-of-bounds write (CWE-787) that corrupts memory and can be leveraged to run attacker-controlled code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms the flaw is reachable over the network with no authentication and no user interaction, making any internet- or partner-facing DataPower instance running an unpatched build a high-priority target. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; patch available per vendor advisory (IBM support page node/7289775), with the specific fixed firmware builds published there.
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, because the affected services deserialize untrusted data received over the network. The flaw is reachable without authentication and without user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), allowing an attacker who can reach the vulnerable endpoint to run arbitrary code with the privileges of the affected process. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but a vendor patch is available and the only practical barrier to exploitation is network reachability of the exposed service.
Unauthenticated remote code execution is possible in Microsoft Azure App Service for Linux because a critical function is exposed without any authentication check (CWE-306). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), an unauthorized attacker can reach the vulnerable functionality over the network and trigger code execution with no credentials, no user interaction, and low attack complexity, yielding high confidentiality, integrity, and availability impact (CVSS 9.8). Microsoft has published an official fix through its MSRC update guide, and no public exploit code has been identified at time of analysis; the residual risk is concentrated on internet-reachable instances still running an unpatched version. The exact function or endpoint involved is not disclosed in the available data, so operators should treat any network-exposed Azure App Service for Linux deployment as potentially affected until patched or confirmed otherwise.
Remote, unauthenticated code execution is possible in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, because an out-of-bounds write in the RFC2047 encoded-word parser can corrupt memory and be leveraged to run arbitrary code. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) indicates the flaw is network-reachable with low complexity, requires no credentials and no user interaction, and carries full confidentiality, integrity, and availability impact, though exploitation depends on a reachable service or flow that passes attacker-controlled data through MIME encoded-word decoding. According to available intelligence there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the primary source is IBM's advisory at https://www.ibm.com/support/pages/node/7289775.
Unauthenticated remote code execution in IBM DataPower Gateway affects the 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 release trains, where a heap-based buffer overflow caused by improper bounds checking lets an attacker who can reach the appliance's request-processing path corrupt heap memory and run arbitrary code with full confidentiality, integrity and availability impact. The flaw is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required, and it is exploitable over the network. There is no public exploit identified at time of analysis and it is not confirmed actively exploited (no CISA KEV listing); IBM has published a vendor fix, and this is a genuine high-priority issue rather than an inflated high-CVSS score.
Missing authentication on a critical management function in IBM Guardium Data Protection 12.2 and 12.2.2 allows unauthenticated remote attackers to invoke arbitrary management operations against the affected appliance, with the highest possible impact to confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Because the CVSS vector specifies PR:N with no user interaction and no non-default configuration prerequisite, any network-reachable management interface or API endpoint on an affected version is potentially exploitable without credentials; the practical constraint is reachability, since Guardium management planes are typically confined to internal or dedicated management segments. At time of analysis there is no CISA KEV entry and no publicly available exploit code identified, so exploitation is assessed as technically straightforward but not yet observed in external telemetry.
Arbitrary code execution in IBM DataPower Gateway is possible when a user with existing local access to the appliance supplies crafted oversized input to a component that performs improper bounds checking, allowing an out-of-bounds write and, potentially, execution of arbitrary code in the appliance's process context. Affected release trains are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; IBM has published a vendor fix, and no public exploit code was identified at time of analysis. Note that the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) characterizes this as remotely exploitable without privileges, which is inconsistent with the description's requirement for a local user and with the independent assessment of AV:L/AC:L/PR:L/UI:N - the local-access prerequisite is the practical limiter on real-world risk, while the impact if triggered remains full confidentiality, integrity, and availability loss.
Missing authentication in the edge-controller component of IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to push and execute arbitrary container images, which in turn grants control over the managed edge clusters that component orchestrates. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for the base case and was independently assessed with scope-changed impact (S:C), reflecting that compromise of the controller extends to the clusters it manages; no credentials, privileges, or user interaction are required against a reachable instance. No public exploit code has been identified at the time of analysis and the issue has not been confirmed as actively exploited (CISA KEV), so the practical risk is driven by network exposure of the edge-controller interface rather than by an observed campaign; a vendor patch is available from IBM.
Empty-password LDAP authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers obtain administrative access to affected appliances by submitting a blank password that the LDAP authentication logic fails to reject. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; exploitation requires only that LDAP be configured for administrative/management authentication and that the authentication interface be network-reachable. At time of analysis there is no public exploit identified, but IBM has published a vendor fix, and the combination of network-only attack surface, no authentication prerequisite, and full confidentiality/integrity/availability impact warrants emergency-level prioritization in any environment using LDAP-backed management logins.
A heap-based buffer overflow in IBM Guardium Data Protection's S-TAP TrafficTap TDS login reassembly routine allows an unauthenticated remote attacker to crash the agent or potentially execute arbitrary code by sending crafted TDS login fragments that overflow the fixed-size reassembly buffer. Affected deployments are Guardium Data Protection (S-TAP agent) versions 12.0 and 12.1, with EUVD additionally listing 12.2; exploitation requires the S-TAP agent to be actively inspecting TDS traffic on a reachable database-communication path, so exposure is limited to networks where an attacker can inject traffic into monitored Microsoft SQL Server or Sybase/SAP ASE sessions. The vendor rates this CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is enabled by a buffer overflow that an unauthenticated network attacker can trigger without user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 9.8, giving total loss of confidentiality, integrity, and availability on a successful exploit. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records no observed exploitation with non-automatable attack steps, and EPSS places exploitation likelihood at 0.37% (29th percentile), so signals are mixed and point to a credible-but-not-yet-urgent priority. The practical limiting factor is network reachability: Guardium is typically deployed as an internal database-activity-monitoring appliance, so an attacker generally needs a foothold on, or routing into, the management or database-monitoring network rather than open internet access.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is possible through a stack-based buffer overflow (CWE-121) in reachable product code, with the vendor CVSS vector indicating a network-accessible, unauthenticated trigger and no required user interaction (AV:N/PR:N/UI:N) and a maximum impact rating of 9.8. Our independent assessment scores the same impact but raises attack complexity to High (AC:H), reflecting that reliable code execution likely requires an attacker to defeat standard memory protections such as stack canaries, ASLR, and DEP, and CISA's SSVC framework rates the issue non-automatable with no observed exploitation; no public exploit identified at time of analysis, and EPSS is low at 0.37% (29th percentile). The practical picture is a high-severity, patch-priority issue rather than an emergency: the vulnerable code is assumed reachable in standard deployments since the advisory names no special prerequisite, but exposure is confined to environments running the three named 12.x releases and the vendor fix closes the window once applied.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated network attackers to trigger a buffer overflow and execute arbitrary code, with total confidentiality, integrity, and availability impact as assessed by CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; EPSS is low (0.37%, 29th percentile), and CISA SSVC marks the attack as not automatable, meaning exploitation would likely require target-specific effort. A vendor patch is available per IBM advisory node/7291674.
Remote code execution in IBM Guardium Data Protection 12.0, 12.1, and 12.2 is achievable by an unauthenticated remote attacker (CVSS PR:N, UI:N) through a buffer overflow that corrupts memory in a way that can be leveraged to run arbitrary code, yielding high confidentiality, integrity, and availability impact (CVSS 8.1). Attack complexity is High (AC:H), so reliable exploitation depends on conditions outside the attacker's control - such as precise memory layout, timing, or a specific non-trivial input path - which tempers the practical risk despite the elevated base score. Only the listed 12.x branches are affected and patched builds are not exploitable; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
Remote, unauthenticated memory corruption in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows an attacker who can reach a monitored MongoDB data path to overflow a heap buffer in the product's MongoDB protocol parser and potentially crash the appliance or execute arbitrary code. The flaw is triggered by a MongoDB SCRAM authentication message carrying an oversized username field, and because the parser runs inside the inspection engine, exposure is limited to deployments where Guardium's S-TAP/collector is actively inspecting MongoDB traffic. The vendor-rated CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a pre-authentication, low-complexity flaw with full confidentiality, integrity, and availability impact, though no public exploit code has been identified at time of analysis and reliable code execution (as opposed to a denial-of-service crash) is constrained by heap-exploitation difficulty.
Remote code execution in IBM DataPower Gateway (10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2) is caused by a heap-based buffer overflow that a remote attacker can trigger without authentication or user interaction, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) with total impact to confidentiality, integrity, and availability. Exploitation is not confirmed by any signal: no public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, SSVC reports Exploitation=none with Automatable=no, and EPSS is only 0.37% (29th percentile). The practical risk therefore hinges on whether affected DataPower builds are reachable from untrusted networks, since IBM has published a fix and the high base score reflects worst-case impact rather than observed attack activity.
OS command injection in IBM Guardium Data Protection 12.2.2 and 12.1 lets a remote attacker execute arbitrary operating-system commands with the privileges of the vulnerable service, yielding a full compromise of confidentiality, integrity, and availability (CVSS 9.8, CWE-78). The CVSS vector rates the flaw as unauthenticated (PR:N) over the network (AV:N) with no user interaction, although IBM's own text does not confirm whether a valid console or API session is needed to reach the vulnerable command path, and the practical risk is narrowed by the fact that Guardium appliances are normally deployed on internal management networks rather than being internet-facing. As of analysis, there is no public exploit code identified, EPSS is low at 0.36% (28th percentile), CISA SSVC records Exploitation: none with Automatable: no, and there is no KEV listing, so the dominant driver of urgency is the severity of impact if an attacker does obtain a path to the interface rather than observed exploitation.
Crafted TDS PRELOGIN packets traversing a network segment monitored by an IBM Guardium Data Protection 12.0, 12.1, or 12.2 Collector trigger a buffer overrun in the appliance's Microsoft SQL Server protocol decoder, reliably causing denial of service and, per the vendor, potentially allowing arbitrary code execution on the Collector itself. Exploitation is unauthenticated (CVSS vector PR:N) and requires no user interaction, but it depends on the attacker's ability to place a malformed packet onto the monitored database network rather than reaching a directly addressable service, because the Collector inspects traffic passively. No public exploit code has been identified at time of analysis and EPSS is low at 0.36% (28th percentile); IBM has published a vendor fix, and CISA's SSVC assessment records no observed exploitation.
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute unauthorized SQL statements against the appliance, with the vendor-assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating full compromise of confidentiality, integrity, and availability of the affected component with no privileges or user interaction required. The vulnerable feature or endpoint is not publicly disclosed, so defenders cannot pin down a specific setting to harden, but the practical gating factor is reachability: Guardium is a data-security management appliance that normally sits on an internal or management network segment rather than the public internet. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but a vendor patch is available and should be treated as high priority because of the 9.8 severity and the sensitivity of the data Guardium manages.
A remotely reachable, unauthenticated out-of-bounds write (buffer overflow, CWE-787) in IBM DataPower Gateway can corrupt memory and potentially allow an attacker to fully compromise the affected appliance, as reflected in the assessed CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with the flaw reachable in the normal network-processing path since no authentication, user interaction, or special configuration is required. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, though the unauthenticated network attack surface and memory-corruption impact make this a genuine high-priority issue for exposed deployments; IBM has published a vendor fix via its support advisory.
SQL injection in IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to execute arbitrary SQL commands against the platform's underlying data store, with IBM's own vector (AV:N/AC:L/PR:N/UI:N, C/I/A:H) describing total loss of confidentiality, integrity, and availability for exposed instances. The headline 9.8 CVSS should be tempered by conflicting signals: EPSS is only 0.30% (20th percentile), and CISA's SSVC assessment records exploitation as 'none' with the attack rated non-automatable, with no public exploit code or KEV listing identified at time of analysis. Real-world risk is governed by reachability - exploitation requires network access to a vulnerable Guardium management or collector interface, which is normally confined to restricted internal management networks rather than the internet.
SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 lets remote unauthenticated attackers who can reach the product's network-facing interfaces inject crafted SQL against the back-end database, potentially viewing, adding, modifying, or deleting its contents (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS is low at 0.27% (17th percentile), so real-world exploitation appears opportunistic rather than widespread despite the maximum severity rating. Impact is exposure-dependent: internet-reachable or broadly accessible management/collector instances carry the full unauthenticated risk, while deployments confined to isolated management networks are substantially less exposed. The vendor has published remediation through IBM Support.
Go's os.Root API on Windows can be tricked into creating a directory outside the sandboxed root when the final path component passed to Root.Mkdir or Root.MkdirAll is a junction that resolves to an empty location, allowing an attacker who can influence filesystem layout or path input to escape the intended root boundary. Only Windows applications built with a vulnerable Go toolchain (os and internal/syscall/windows before 1.26.9, or the 1.27.0 pre-release line before 1.27.2) that actually use os.Root are affected; non-Windows builds and applications not using os.Root are not impacted. The headline CVSS 9.8 overstates real-world risk: our independent assessment scores it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because the primitive is confined to directory creation outside the root, with no arbitrary file read, content write, or code execution described. EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Authentication bypass in the Ultimate Multisite WordPress plugin before 2.17.0 lets an unauthenticated remote attacker (CVSS PR:N) log in as any existing WordPress account, including a Network Super Admin, whose email address they know - but only on sites whose checkout form is configured without a password field and only when the target account has no existing Ultimate Multisite customer record. The root cause is that the plugin's duplicate-account check normalizes the submitted email address differently from the lookup used to create the customer, so a logged-out checkout silently links to and authenticates as the matching existing WordPress user. The 2.15.1 fix for CVE-2026-75957 does not remediate this bypass; vendor-released patch 2.17.0 is available, and no public exploit code has been identified at time of analysis (no CISA KEV entry). Vendor CVSS is 9.8, though our independent assessment applies AC:H (8.1) because both the password-less checkout configuration and the absence of a pre-existing customer record are required.
Unauthenticated account takeover, including full administrator compromise, affects WordPress sites running the Frontend Dashboard plugin versions 3.0.0 up to but not including 3.0.5. Missing authorization and nonce checks on actions available to unauthenticated users allow an attacker to invoke an arbitrary PHP function or class method with attacker-controlled arguments, resulting in complete loss of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a patch in version 3.0.5.
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in the ZMQ message decoder, which processes PickleWrapper payloads via pickle.loads() without type allowlisting or authentication. While default single-node deployments bind the ZMQ control channel to loopback, remote exploitation becomes possible when data-parallel attention is enabled and --dist-init-addr is set to a non-loopback address. Disabling SGLANG_USE_PICKLE_IPC does not eliminate the risk because the msgpack code path still reaches pickle.loads(), and no public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in the AKINSOFT WOLVOX Control Panel (versions 26.02.25 up to but not including 26.02.26) lets a remote attacker reach the panel over the network and pull sensitive data from system resources into responses sent back to the client. Because the assessed attack vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed against an internet- or network-reachable instance, and successful exploitation yields high confidentiality impact (C:H), exposing host/system-level information to an unauthorized party. Note that the supplied base vector (9.8) also asserts high integrity and availability impact, whereas the independent assessment scopes the issue to confidentiality only (I:N/A:N); either way the practical effect is data exposure rather than code execution or service disruption. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix.
Unauthenticated OS command injection in Dromara Skyeye allows remote attackers to execute arbitrary commands as the Skyeye service account on Windows. The flaw resides in the TTS textToSpeech endpoint, where the 'format' parameter is concatenated into a PowerShell string without sanitization; a single quote can break out and run attacker-supplied commands. Exploitation requires the instance to be running on Windows and the endpoint to be network-reachable, but no authentication or user interaction is needed, making default deployments a high-priority target. No public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in the image_optimizer Ruby gem versions 1.3.0 through 1.9.0 allows unauthenticated remote attackers to execute arbitrary shell commands with the privileges of the Ruby process by supplying an image path containing shell metacharacters such as ';'. The flaw is reachable only when the consuming application enables the 'identify' option (so that ImageOptimizer#identify_format runs) and the attacker controls the image path argument, typically through an attacker-chosen uploaded file name, which means real-world impact is bounded by the OS privileges of the Ruby/web worker process and by whether user-controlled filenames reach the gem. The CVSS 4.0 base score of 9.3 reflects high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis; the included gist and VulnCheck advisory serve as the primary public technical disclosures.
OS command injection in the ppt2png Node.js library (through version 0.0.6) lets attackers run arbitrary operating system commands by embedding shell metacharacters such as ';' in the input or output path arguments that the library concatenates into a child_process.exec() call in ppt2png.js. The vulnerable code is only reachable when a consuming application forwards attacker-controllable data into those path parameters; exploitation is therefore conditional on the embedding application, but when reachable the injected commands execute with the full privileges of the Node.js process, and no authentication is required per the assessed vector (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, CVSS 4.0 base 9.3). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but the near-maximum severity and trivial injection technique make prompt remediation or strict path sanitization critical for any deployment that exposes these parameters.
Unauthenticated remote command execution in Openfind SecuShare Pro allows attackers to inject and execute arbitrary operating system commands on the server, as described in CVE-2026-107459 (CVSS 9.3, CWE-78). The flaw affects default internet-exposed deployments that are reachable over the network, and no public exploit has been identified at time of analysis. Successful exploitation grants full control over the affected system, enabling data theft, malware installation, or lateral movement.
Remote unauthenticated attackers can obtain a fully privileged administrative session on TVU Networks Receiver and Transceiver devices running firmware before 7.9 by sending a crafted HTTP request to the web management login endpoint POST /tvu/Login with an empty or absent UserName parameter; the password value is irrelevant and a valid session cookie is returned. The flaw is rated CVSS 4.0 9.3 (and assessed as CVSS 3.1 9.3 with high confidentiality, integrity, and availability impact), requires no authentication, no user interaction, and no non-default configuration, and because the request is issued directly it defeats the client-side JavaScript validation that would otherwise block it. No public exploit code or confirmed active exploitation was identified at time of analysis; the main practical limiting factor is network reachability of the device's management interface, so segmented or non-exposed management planes are not remotely exploitable.
Unauthenticated attackers can execute arbitrary commands on Dromara Skyeye's bundled xxl-job executor hosts by abusing JobInfoController endpoints that are annotated @PermissionLimit(limit = false). The flaw affects Skyeye deployments through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 and requires the xxl-job-admin console to be network-reachable with at least one registered executor; exploitation allows creating and starting GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-controlled glueSource. No public exploit code has been identified at time of analysis, but the vulnerability carries a CVSS v4.0 base score of 9.3 and our independent assessment rates it as CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, making it a genuine high-priority issue.
Command injection in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) lets an authenticated, low-privileged user execute arbitrary operating-system commands as SYSTEM on the primary domain controller emulator (PDCe). Both the vendor CVSS 4.0 vector (9.4) and our independent CVSS 3.1 assessment agree on PR:L with UI:N and changed scope, meaning an attacker who already holds a valid low-privileged tenant account needs no user interaction and faces low attack complexity to pivot from tenant access to domain-controller-level code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact is severe and the barrier of entry is only an existing credential, so this should be treated as a high-priority remediation.
Arbitrary memory disclosure and denial of service in Hazelcast allow a client that can reach a cluster member's listening port to read arbitrary data from that member's Java heap, off-heap storage and JVM process address space, to crash members, and - in some Hazelcast Enterprise Edition configurations - to corrupt memory with possible remote code execution. All editions prior to 5.4.5, 5.5.10, 5.6.1 and 5.7.0 are affected in both the slim and full distributions, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a low-privileged client credential where client authorization is enforced, while in default deployments with Hazelcast Security disabled any reachable client can connect without credentials; the vendor's CVSS 4.0 score of 9.3 assumes PR:N. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but vendor-released patches exist (5.4.5, 5.5.10, 5.6.1, 5.7.0) and the vendor's own hardening guidance - enabling security, enforcing client authorization and defining an explicit zero-config Compact serialization allowlist - directly addresses the exposure, making this a genuine high-priority vulnerability rather than an inflated score.
Missing authentication in TVU Networks Receiver/Transceiver firmware before 7.9 exposes the device web-management REST API on TCP port 8288, letting remote unauthenticated attackers read sensitive device information and modify configuration-including rewriting DNS via /Setting3/API/API/v1/LocalNetwork/DNS to enable man-in-the-middle attacks on outbound TVU cloud connections. The issue is scored CVSS 9.3 (v4.0) and independently assessed as AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:N under CVSS 3.1, with practical impact limited mainly by whether port 8288 is reachable from an untrusted network. No public exploit was identified at time of analysis.
OS command injection in @enmaso/node-convert through 1.0.0 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by placing shell metacharacters or a single quote into the filepath or convertTo arguments that convert.js concatenates into an ImageMagick command executed via child_process.exec(). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both frame this as full-impact code execution, but practical exploitation requires a consuming application to pass attacker-influenced data into those two parameters and to have the vulnerable call path (and ImageMagick) reachable - deployments that only pass trusted or internally fixed values are not remotely triggerable. All versions through 1.0.0 are affected, and no public exploit code has been identified at time of analysis.
Remote code execution in dot-access versions 0.0.3 through 1.0.0 allows unauthenticated attackers to execute arbitrary JavaScript and operating system commands when a consuming application passes attacker-controlled input as the path argument to the get() function. The vulnerability arises from unsanitized path concatenation into a dynamically constructed Function body, enabling access to constructor.constructor and child_process. No public exploit code was identified at time of analysis, but the CVSS 4.0 score of 9.3 reflects high confidentiality, integrity, and availability impact. Exploitation is conditional on untrusted input reaching get().
Unauthenticated SQL execution in mJobTime (all builds through 15.7.3.32) allows any remote attacker who can reach Login.aspx to submit arbitrary SQL that executes with DBA/sysadmin privileges on the backing Sybase SQL Anywhere database and, via xp_cmdshell and xp_read_file, achieve remote code execution as LocalSystem in a single HTTP request. The runQueryButton postback and exportSqlQuery_Server PageMethod are gated only by a client-side sessionStorage flag, so no credentials, user interaction, or non-default configuration are required (independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, consistent with the reported CVSS 4.0 score of 9.3 under AV:N/AC:L/AT:N/PR:N/UI:N). There is no CISA KEV listing for this CVE and no public exploit identified at time of analysis, though the technique is documented in the VulnCheck advisory and Sprocket Security write-up.