Authorization bypass in the Hazelcast IMap Predicates API allows a client holding only limited cluster credentials to execute arbitrary code on a Hazelcast cluster member in versions prior to 5.4.5, 5.5.10, 5.6.1 and 5.7.0. Because the missing check sits inside the map permission model itself, a partially trusted client - for instance one granted read or put rights on a single map - can invoke the aggregation and projection query paths that were never gated by a permission bit, yielding full compromise of confidentiality, integrity and availability on the member (CVSS 4.0 base 8.7 High; vendor-assessed CVSS 3.1 8.7 with PR:L). Exploitation requires an authenticated client connection to the cluster, so it is not reachable by fully unauthenticated attackers; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor states no workaround exists other than upgrading.
Intego Antivirus for Windows through 3.0.0.1 permits a local unprivileged user to escalate to SYSTEM by exploiting a link-following flaw (CWE-59) in its optimization module. A scanned duplicate file's directory can be replaced with an NTFS junction to C:\Config.msi, allowing arbitrary folder deletion with SYSTEM rights and abuse of Windows Installer rollback to execute code as SYSTEM. Publicly available exploit code exists, but exploitation requires a pre-existing low-privileged interactive Windows account and use of the optimization/duplicate-scan module; this is a credible but bounded local privilege-escalation risk rather than a mass-exploitation emergency.
Local privilege escalation in Deskin 3.3.4.3 and earlier on macOS allows any local unprivileged process to gain full root by connecting to the root-owned com.deskin.service.installer XPC service, which performs no client authentication, and invoking its privileged installer method with an attacker-supplied installer package. Because the flaw (CWE-306) sits on a local Mach/IPC path, an attacker must already hold a local account or code-execution foothold on a host where Deskin is installed and the installer service is running, making it a post-compromise escalation primitive rather than an initial access vector. Publicly available exploit code exists (GitHub PoC, reported via VulnCheck) but there is no confirmed active exploitation (CISA KEV) at time of analysis; the submitted CVSS 4.0 score of 8.5 and the independently assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) both reflect high confidentiality, integrity and availability impact once the local prerequisite is satisfied.
EspoCRM deployments before 10.0.5 allow an authenticated user with Email Account scope to retrieve other users' stored IMAP passwords via an insecure direct object reference in PersonalAccount\Service, enabling mailbox compromise. Attackers must know or enumerate a victim's Email Account record ID, and publicly available exploit code exists; there is no confirmation of active exploitation (CISA KEV) at time of analysis. The vulnerability is a confidentiality-only issue with changed scope, rated high risk because it exposes reusable credentials.
Signed JSON Web Tokens whose payload is a JSON array silently bypass every configured claim validator in the npm package fast-jwt through version 6.2.4, so the verifier returns success while enforcing only the signature and skipping exp, nbf, iss, aud, sub, jti and nonce checks. The flaw is exploitable by an authenticated attacker (CVSS PR:L) who can produce or influence a validly-signed token - signature verification itself is not broken, so the attacker must have access to the signing key or to a token-issuance path that lets them control the payload structure - and the true risk is gated by that precondition and by AC:H rather than the raw 8.1 base score. Publicly available exploit code exists in the vendor advisory, but there is no confirmed active exploitation (not in CISA KEV) and exploitation is blocked entirely in deployments that enable the opt-in requiredClaims option or that have upgraded to 6.3.0.
Processing an attacker-controlled Protobuf schema with datamodel-code-generator 0.59.0 through 0.80.0 lets a crafted weak-import path escape the `__weak_imports__` temporary directory, creating directory trees and new files, or overwriting existing files that are writable by the running process (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N; the vendor-reported vector is 7.5 with a higher integrity rating). Exploitation requires a victim or automated CI job to invoke the tool with `--input-file-type protobuf` on a malicious .proto supplied locally via `--input` or remotely via `--url`, and the grpcio-tools package must be installed to enable Protobuf input support; the payload is limited to a `syntax = "proto2";` or `syntax = "proto3";` declaration, so fully attacker-controlled content and direct arbitrary code execution have not been demonstrated. No active exploitation is confirmed (not in CISA KEV), though the upstream GitHub advisory carries a proof-of-concept and technical write-up, and the fix ships in version 0.81.0.
Strawberry GraphQL versions 0.217.0 through 0.326.0 contain an authorization bypass in which a custom permission class whose has_permission() is declared as a synchronous def but returns an awaitable (for example a coroutine) can grant access to fields that should be denied. Because only async def methods are detected as asynchronous, the returned awaitable is evaluated for truthiness on the synchronous resolve path and is always truthy, so the protected resolver runs even when the awaitable would resolve to False. The flaw affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def or returning a plain boolean are unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis, though the patch is a single small commit (PR #4605) that is easy to reverse-engineer.
Memory exhaustion in Go's standard-library net/http HTTP/2 server lets a remote attacker send a single crafted request whose "Trailer" header declares an excessive number of fields, causing the server to allocate a disproportionately large Request.Trailer map for the handler. The issue is availability-only (C:N/I:N/A:H), requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and crucially bypasses the Server.MaxHeaderValueCount and Server.MaxHeaderBytes defenses; HTTP/1 servers are not affected because they do not multiplex many requests over one connection and account for MaxHeaderBytes differently. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.23% (12th percentile), and vendor patches are available, so this is a genuine but moderate-priority availability bug rather than an emergency.
Denial of service through CPU exhaustion in Go's HTTP/2 implementation (net/http and golang.org/x/net) lets an unauthenticated remote HTTP/2 peer open many streams and then repeatedly send small SETTINGS frames carrying SETTINGS_INITIAL_WINDOW_SIZE, forcing the victim to recompute per-stream flow-control window state at O(number of streams) for each frame (assessed CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability - there is no confidentiality or integrity loss - and exposure is limited to Go programs with HTTP/2 active: servers over TLS (the Go default) and Go HTTP/2 clients connecting to an attacker-controlled peer, in versions predating the O(1) initial-window-size fix tracked in Go issue 81742. No public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); HTTP/1-only deployments are unaffected.
Concurrent mutation of the shared HPACK encoder in Go's HTTP/2 server stack (net/http, also reachable via golang.org/x/net/http2, tracked as GO-2026-6617) allows remote, unauthenticated attackers to crash the process by repeatedly issuing requests while sending SETTINGS frames that change SETTINGS_HEADER_TABLE_SIZE. One goroutine encodes a HEADERS frame for an outgoing response while another resizes the encoder's dynamic table with no synchronization, producing a data race (CWE-362) that can terminate the server. The impact is availability only (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H); exploitation is timing-dependent and requires HTTP/2 to be enabled, but publicly available exploit code exists and EPSS is low at roughly 0.18% (7th percentile). There is no confirmed active exploitation (CISA KEV does not list this CVE), and a vendor patch is available per vendor advisory.
Authentication and authorization bypass in fast-jwt 6.3.0 and earlier lets a remote, unauthenticated attacker submit a forged unsigned JWT containing arbitrary claims and have it accepted without possessing any signing key. The defect is reachable only when an application instantiates createVerifier with a falsy synchronous key (an empty string '' or null) while also supplying a non-empty algorithms allowlist such as ['HS256']; that combination causes prepareKeyOrSecret to be skipped, hasKey to evaluate false, and the empty signature segment of an unsigned token to bypass the verifySignature gate entirely. The issue is fixed in 6.3.1, and no public exploit code was identified at time of analysis - the primary real-world limiter is that the vulnerable configuration is non-default and developer-introduced, though once such a verifier exists no privileges or user interaction are required of the attacker.
Infinite loop in FFmpeg's HLS demuxer (libavformat/hls.c) lets remote attackers pin CPU and I/O indefinitely on any host that feeds a crafted playlist to FFmpeg before version 8.1.3. A malicious Media Playlist that embeds Master Playlist tags causes parse_playlist()/hls_read_header() to keep registering self-referencing variants that never terminate. Exploitation is unauthenticated (PR:N) but requires a victim or automated pipeline to open the playlist (UI:P), impact is availability-only with no data disclosure or code execution, and publicly available exploit code exists; there is no confirmed active exploitation (CISA KEV) at time of analysis.
FFmpeg through 9.0.2 contains an infinite loop in ff_rtsp_connect() (libavformat/rtsp.c) because the RTSP client follows 3xx redirects without a redirect limit, allowing a malicious RTSP server to cause endless reconnects that saturate a CPU core. Exploitation is remote and unauthenticated (CVSS PR:N) but requires passive user interaction (UI:P/UI:R): the victim must open an RTSP stream that resolves to the attacker-controlled server, which then answers every request with a 302 redirect to itself or another server. Publicly available exploit code exists (a gist PoC), but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a genuine but bounded availability threat, with the highest exposure in services that accept and open user-supplied RTSP URLs automatically.
Relative path traversal in Satel Netco Design versions prior to v2.1.7 lets an authenticated user holding only Viewer privileges write attacker-influenced files to any filesystem location reachable by the application service account, which can escalate to arbitrary code execution where a writable location is later executed or loaded by the service. The flaw affects the product's data export functionality (CWE-23) and is remotely reachable over the network, but requires a valid low-privileged account (CVSS 3.1 vector PR:L), so anonymous access is not sufficient. Rated 8.7 under CVSS 4.0 and reported through CISA ICS-CERT advisory ICSA-26-281-03; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. The full RCE outcome is conditional on deployment-specific file-write-then-execute paths; absent those, impact is confined to unauthorized file creation or modification within application-accessible directories.
Stored cross-site scripting in Satel Netco Design versions prior to v2.1.7 allows an authenticated user with Network Operator privileges to persist untrusted content that the application later renders without adequate neutralization, causing script execution in another user's browser when that content is viewed. Exploitation is a two-step chain: an attacker must already hold or compromise a privileged Network Operator account to plant the payload, and a separate user must subsequently open the affected page for the script to fire (CVSS 4.0 base 8.5 High; the independent assessment scores it CVSS 3.1 with scope change but only low confidentiality and integrity impact and no availability impact). No public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the fix is to upgrade to v2.1.7 per the vendor advisory published through CISA ICS (ICSA-26-281-03).
Information disclosure in Microsoft's Azure API Center lets remote unauthenticated attackers read sensitive data outside their intended authorization scope, with the changed-scope (S:C) rating indicating the leak can cross the vulnerable component's security boundary - consistent with a multi-tenant, Microsoft-operated cloud service. Microsoft's CNA vector scores 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C), while our independent assessment narrows impact to confidentiality only (I:N) and keeps the high attack complexity, meaning attacker-controlled preconditions such as target-specific knowledge or request sequencing are required; there is no public exploit identified at time of analysis and no CISA KEV listing. Because the service is vendor-operated SaaS, exposure was bounded by the window before Microsoft's server-side fix was deployed, and customers cannot self-mitigate beyond relying on that fix.
Privilege escalation in Microsoft Azure SRE Agent lets an authenticated, low-privileged user exploit a missing authorization check in a server-side request-forwarding (SSRF) path to reach resources and act with the agent's higher-privileged identity, yielding high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Because the flaw sits in a Microsoft-managed cloud service, no customer-side configuration is required to trigger it - the only real gate is that the attacker must already hold a valid, authorized low-privileged identity in the service (PR:L, matching the advisory's 'authorized attacker' wording). Risk signals are moderate rather than urgent: EPSS is 0.39% (31st percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis; a vendor patch is available per Microsoft's advisory.
Authenticated users holding only Viewer privileges on Satel Netco Design can degrade availability of the application by submitting specially crafted search input that drives excessive processing in the product's regular-expression handling. The issue affects all versions prior to v2.1.7 and is rated CVSS 7.1 (CVSS 4.0) / High under CVSS 3.1 for availability impact alone - there is no confidentiality or integrity loss. Exploitation requires a valid, low-privileged account and network reachability to the search functionality; no public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV).
OS command injection in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an authenticated, low-privilege administrative user with adjacent-network access to the management plane to break out of the restricted management environment and execute arbitrary shell commands with elevated privileges by supplying a crafted timezone string to the time and zone management subsystem via the REST API or configuration download routines. No user interaction is required, and the reporter scores it 8.6 under CVSS 4.0, while our independent assessment concurs on high confidentiality, integrity, and availability impact under AV:A/AC:L/PR:L/UI:N/S:U. There is no public exploit identified at time of analysis and no confirmed active exploitation; because valid management credentials and adjacency to the switch management network are both mandatory, this is a credible elevated-priority issue rather than an emergency.
Unrestricted file upload in the Super Forms - Drag & Drop Form Builder WordPress plugin (all versions up to and including 6.3.316) lets an attacker write attacker-controlled file types to the server, which can be turned into remote code execution. Exploitation is a two-step chain: an authenticated Subscriber-level user poisons the _super_elements post meta with a crafted extensions string through the super_save_form AJAX handler, which lacks capability and nonce checks, and then the super_upload_files endpoint - which requires no authentication at all - applies that string verbatim as its allowed MIME-type map and accepts an executable file. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with the practical barrier being acquisition of a low-privileged account, which is trivial on sites with open registration; no public exploit identified at time of analysis.
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galaxy collection install` against a crafted collection tarball, because the archive extractor validates member paths with lexical normalization (os.path.abspath) instead of resolving symlinks (os.path.realpath) and performs no containment check on symlink-typed directory members before creating them, letting chained symlink entries redirect a subsequent file member outside the destination directory. The flaw (CWE-59, CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a bypass of the fix for CVE-2020-10691 and requires the victim to actively install the malicious collection, so an attacker can write arbitrary files with the privileges of the ansible-galaxy user and potentially achieve code execution on the control node. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; affected deployments include ansible-core 2.x as shipped in Red Hat Ansible Automation Platform 2 and numerous other Red Hat products, and no patched version is identified in the supplied intelligence, which currently cites only the Red Hat CVE page and Bugzilla 2531646.
Remote code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including the containerized editions of both products, because a protection mechanism fails to prevent an authenticated principal from influencing code execution paths. Successful exploitation requires only a valid low-privilege account and network access to the product interface (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) - no user interaction or race condition is needed - and yields full compromise of confidentiality, integrity and availability of the affected instance. At the time of analysis, no public exploit code has been identified for this CVE and there is no confirmed active exploitation, but the low attack complexity and the fact that the affected systems are identity and access management infrastructure make the issue a high-priority patching target; IBM has published a vendor remediation advisory.
Remote code execution is possible in IBM Guardium Data Protection 12.0, 12.1, and 12.2 through a buffer overflow (CWE-119) triggered over the network, but exploitation requires valid low-privileged credentials (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, base 8.8) - this is not an unauthenticated flaw, so an attacker must already hold an account or captured credential on the appliance. A successful exploit yields full compromise of confidentiality, integrity, and availability of the affected system, making privileged accounts and network reachability the key gating factors. Exploitation status is benign-to-moderate: no public exploit code has been identified and no confirmed in-the-wild activity is reported (EPSS 0.42%, 34th percentile; CISA SSVC exploitation: none), and IBM has published an advisory with a vendor fix, so patching is the decisive control.
Arbitrary command execution in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container images) allows a remote attacker holding a valid low-privilege account to run commands on the underlying system by slipping argument delimiters into data that is passed to a backend process without neutralization (CWE-88). The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) means the attack is network-reachable with no user interaction and yields full loss of confidentiality, integrity, and availability, but exploitation is not possible fully unauthenticated - the attacker must already have credentials, which narrows the realistic threat to insiders, compromised low-privilege accounts, and post-compromise escalation. There is no public exploit identified at time of analysis, though the vendor has published a patch, so unpatched deployments within the affected ranges should be treated as exposed to any authenticated user.
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the containerized editions) allows a remote attacker who already holds valid credentials to slip crafted parameters into command or process arguments and trigger unauthorized actions, with high impact to confidentiality, integrity, and availability (CVSS 8.8). Exploitation requires authenticated access (CVSS vector PR:L) and no user interaction (UI:N), so the exposed population is limited to existing platform users rather than anonymous internet traffic. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and the affected systems are typically high-value identity infrastructure, making prompt remediation worthwhile.
SQL injection in the generated reactive entity-list endpoints of JHipster-produced applications (generator-jhipster versions 7.0.0 up to, but not including, 9.4.0) lets an authenticated user inject arbitrary SQL through the attacker-controlled `sort` request parameter on `GET /api/<entity>?sort=...` endpoints. Because the generated R2DBC code passes the sort property into the SQL ORDER BY clause unvalidated and unquoted, and the driver runs it over the simple query protocol, semicolon-separated statements are executed as well - enabling reads of sensitive tables such as `jhi_user` password hashes, modification or deletion of data, and table drops (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the app to be the reactive WebFlux + Spring Data R2DBC + SQL stack, and an account is needed, though the default self-registration flow lets a low-privileged one be self-provisioned; the vendor-released fix is version 9.4.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Prototype pollution in dot-access through 1.0.0 allows remote attackers to modify Object.prototype when a consuming application passes an attacker-influenced dotted path to set(). By injecting __proto__ path segments, attackers can alter authorization flags or option defaults across all objects and may crash the process; the flaw is CWE-1321, rated 8.8 in CVSS 4.0, and assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L with high integrity and low availability impact. No public exploit identified at time of analysis and no CISA KEV confirmation; exploitation is integration-specific because the path argument must be attacker-controlled.
PHP object injection in the MainWP Child plugin through version 6.2.1 allows unauthenticated remote attackers to fully compromise confidentiality, integrity, and availability, though exploitation requires user interaction and a viable PHP gadget chain. The vulnerability is a deserialization of untrusted data (CWE-502) issue with a CVSS 3.1 base score of 8.8, rated high risk. No public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in ILIAS LMS (before 9.24, 10.x before 10.12, and 11.x before 11.5) allows an authenticated user with test-question authoring rights to inject ImageMagick convert options through the filename of an uploaded image in an image-map question. Because escapeshellcmd() does not neutralise tab characters, an author can smuggle extra command arguments that instruct convert to drop a PHP file under the web root, which is then executable by any visitor and yields remote code execution on the server. Exploitation requires a tutor/instructor-level account with access to assImagemapQuestionGUI, no public exploit code has been identified at time of analysis, and a vendor patch is available.
Cross-site request forgery in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions) lets a remote attacker who lures a logged-in user into loading attacker-controlled content submit unauthorized, privileged state-changing requests through that victim's authenticated session; CVSS 3.1 rates it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attacker needs no credentials of their own, but successful abuse depends on a concurrently authenticated victim - most damagingly an administrator - plus a social-engineering/user-interaction step, so exposure is greatest where the management interface is internet-reachable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); a vendor patch is available per IBM's advisory.
Cross-site request forgery in the Melapress WP 2FA WordPress plugin, affecting all versions through 4.1.0, allows an attacker to make a logged-in privileged WordPress user - typically an administrator with access to the two-factor authentication settings - perform unintended state-changing WP 2FA actions by tricking them into visiting a malicious page or link while their session is active. The input CVSS 3.1 vector scores 8.8 (High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but an independent reassessment places integrity impact as the dominant concern (C:L/I:H/A:N), since exploitation is wholly dependent on a victim who is both authenticated and successfully lured into interaction (UI:R); no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing). Despite the high headline score, the practical attack surface is constrained by the required user interaction, a valid privileged session at the time of the lure, and the fact that the specific vulnerable endpoint and action are not disclosed in the available data; the underlying defect is a missing or inadequate anti-CSRF nonce check on a WP 2FA request in versions up to and including 4.1.0.
Authorization bypass in OctoCloud 1.12.06 lets an authenticated low-privilege user access functionality and data they should not be permitted to reach, because the application trusts a user-supplied key when making access-control decisions. Successful exploitation allows high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), though the attacker must already hold a valid low-privilege account - this is not a remote-unauthenticated flaw. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied; the vulnerable endpoint and parameter are not disclosed in the available TR-CERT advisory. Only the 1.12.06 release line up to (but not including) 1.12.07 is affected.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allows a low-privilege Fabric OS account - or an attacker who controls a directory-service account trusted by the switch - to smuggle shell metacharacters into connection-validation and session-verification input and reach internal execution wrappers, running arbitrary operating-system commands with elevated privileges on the SAN switch. Only Fabric OS versions before 10.0.1 are affected, and exploitation requires network reachability to the management interface over an adjacent or management network plus prior authentication (CVSS:4.0 base 8.6; the independent assessment concurs on AV:A/PR:L/UI:N with high confidentiality, integrity and availability impact). No public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best treated as an insider/lateral-movement risk on segmentation-exposed management planes rather than an opportunistic internet-facing emergency.
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated, high-privileged administrator execute arbitrary commands as root on the underlying switch host by supplying shell metacharacters in SSH known-host configuration parameters. Affected deployments are Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 range; the vulnerability carries a CVSS v4.0 base score of 8.5 (High) and an equivalent CVSS v3.1 assessment of 8.5, with the practical risk tempered because an attacker must already hold administrative rights and reach the switch over an adjacent management network rather than the open Internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a constrained-priority issue for SAN administrators rather than an emergency patch-everything event.
Memory corruption in MongoDB libmongocrypt lets an authenticated actor who can modify key vault documents - or a malicious or compromised MongoDB server - crash or corrupt the memory of any client application that has Client-Side Field Level Encryption (CSFLE) or Queryable Encryption enabled. The trigger is a crafted key document containing duplicate masterKey fields, which causes provider-specific KMS data to be mis-typed during key-document cleanup, producing invalid memory access and invalid frees (CWE-843 type confusion). Scored 8.7 under CVSS 4.0, while our own assessment is more conservative at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H, placing the confirmed impact at client-side crash and memory corruption rather than proven remote code execution; no public exploit code identified at time of analysis, and exploitation requires that encryption be in use plus key-vault write privileges (PR:L) or a hostile server.
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privileged user execute arbitrary shell commands as root on the switch by supplying crafted parameter strings during configuration download or file-transfer operations that use remote server profiles. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation is gated by two hard prerequisites, namely an account already holding the specific config-download permission (PR:H) and adjacent-network reachability to the switch management interface (AV:A), with high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 8.5). There is no public exploit code and no active exploitation identified at time of analysis, so this is a genuine but conditionally-gated risk requiring privileged management-network access rather than a remotely reachable, drop-everything emergency.
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass in its HTTPS JSON API dispatcher that allows an attacker on the adjacent network to append an onboarding-scoped object to a JSON request and thereby skip session verification, invoking privileged actions without credentials. Successful exploitation can expose live video and audio, modify device settings, and disclose sensitive device information or secrets. The vendor has released patched firmware, no public exploit code was identified at time of analysis, and independent assessment rates the issue high severity under CVSS 3.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with the adjacent-network requirement the primary limiting factor.
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthenticated attacker crash or potentially execute code on affected switches by sending a specially crafted SNMPv3 packet. The flaw sits in an internal statistics handler that copies the attacker-supplied SNMPv3 context name into a fixed-size stack buffer without validating its length, producing memory corruption that the vendor says is reachable under default configuration. Per the assessed vector (AV:A/PR:N/UI:N, C/H/I/A:H), the attacker must be on an adjacent network segment with reachability to the switch's SNMP service (UDP/161) - a materially limiting factor, since switches with SNMP isolated on a dedicated management VLAN are much harder to hit - and no authentication or user interaction is required; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Incorrect authorization in Octopus Server causes the platform to evaluate multiple scoped permission assignments incorrectly, so an already-authenticated, highly privileged user can accumulate deployment permissions beyond those actually granted to them. This is an authenticated (PR:L) network-reachable flaw requiring a valid Octopus account that already holds scoped permission assignments; the realistic threat actor is a malicious insider or an attacker using a compromised legitimate account rather than an anonymous internet attacker, and no victim interaction is needed. With C:H/I:H/A:H, successful abuse can alter and deploy code across environments the user was never authorized to touch. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the 8.7 CVSS severity and default multi-scope evaluation behavior make it a priority for organizations relying on Octopus scoping for separation of duties.
Predictable pre-shared key generation in the TP-Link Tapo C325WB V2 camera's local media streaming service allows an unauthenticated attacker on the adjacent network to recover the key and authenticate to the stream without credentials. This enables access and takeover of live video and audio feeds, compromising confidentiality and integrity. The vulnerability is rated 8.7 (High) with no public exploit identified at time of analysis; a vendor firmware patch is available.
Unauthenticated control-plane takeover in the Brocade Active Support Connectivity Gateway (ASCG) HTTPS service allows a network-adjacent attacker to issue control commands, alter cluster state, and modify system configuration in every release before 3.5.0. The defect is a plain missing-authentication condition (CWE-306): no credentials, tokens, or user interaction are involved, and no non-default configuration is required, since the HTTPS control interface simply does not enforce authentication or access control on incoming requests. The principal limiting factor is reachability rather than exploit complexity - the vendor scores it CVSS 4.0 8.7 with AV:A/PR:N/UI:N (adjacent, unauthenticated, no user interaction), so the attacker must already have a foothold on the appliance's management or local network segment. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so urgency is driven by how widely the management interface is exposed on flat or loosely segmented networks.
Unauthenticated API access in Brocade ASCG (Active Support Connectivity Gateway) before version 3.5.0 lets an attacker on an adjacent network perform privileged administrative actions - reading sensitive system configuration mapping data, modifying managed device inventories, and changing operational settings - without presenting any credentials. The flaw is scored CVSS 8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L) and is rooted in CWE-306, a missing authentication check for a critical function; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). The dominant constraint is reachability rather than skill: the attacker must be able to route to the ASCG administrative management/API interface from an adjacent or logically local segment, so deployments that place the appliance behind segmentation or firewalls are materially less exposed.
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user to execute arbitrary operating-system commands on the affected switch, giving high confidentiality and integrity impact to the attacked system while availability is not directly affected. Only Fabric OS releases before 10.0.1 are affected, and because the CVSS vector requires adjacent-network reachability (AV:A) plus valid credentials (PR:L), the practical attack path runs through the switch management VLAN or an equivalent segmented management plane rather than the public internet. Scoring 8.5, this is a genuinely serious but not top-tier remote-exploitation risk: no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so exposure is driven mainly by whether the REST API management interface is enabled and reachable from untrusted adjacent segments.
CPU exhaustion during SVG rendering in CairoSVG versions prior to 2.9.1 lets an unauthenticated remote attacker deny service to any application that converts untrusted SVG input. A path element containing a large number of segments drives quadratic (O(n²)) work in cairosvg/path.py, where the tokenizer repeatedly slices and rescans the remaining path data and draw_markers drains node.vertices with pop(0); a payload well under one megabyte is sufficient to consume substantial CPU. The svg2png, svg2pdf, and svg2ps APIs all reach the vulnerable code during ordinary rendering, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H with VC:N/VI:N) confirms this is a pure availability impact requiring no authentication or user interaction; no public exploit code has been identified at time of analysis. Risk is therefore concentrated in services that render user-supplied SVGs, while deployments that only process trusted, developer-authored SVG files are not meaningfully exposed.
OpenStack Mistral through 23.0.0 exposes an authenticated command-injection path in its std.ssh_proxied action: the caller-supplied proxy_command string is handed to paramiko.ProxyCommand() and executed as a local subprocess on the executor host under the Mistral service account, before any SSH connection to the gateway or target host is even attempted. Any authenticated project member who can reach the standard action-execution API can therefore run arbitrary OS commands on the Mistral executor, with the default configuration affected because std.ssh_proxied is permitted out of the box; deployments that explicitly disable or restrict that action are not impacted. Exploitation requires valid project credentials (PR:L, not anonymous), so the practical risk is privilege escalation and lateral movement from a low-privileged tenant account rather than unauthenticated compromise, and no public exploit code was identified at time of analysis.
Quadratic-time denial of service in league/commonmark 2.0.0 through 2.10.1 lets unauthenticated remote attackers exhaust PHP worker CPU by submitting a single large Markdown paragraph made of pipe-free lines that do not begin with a letter, which forces the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() to rescan the entire growing paragraph buffer on every line. Successfully exploited, this drives seconds to tens of seconds of single-core CPU per request that scales with the square of the input size, enough to saturate worker pools and deny service to other users. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis, though the attack is trivially derived from the published advisory; impact is limited to availability with no confidentiality or integrity effect, and only applications that render untrusted Markdown with the Table extension enabled are affected.
Deeply nested DICOM sequence (SQ) elements delivered to a DCMTK 3.7.0-based service drive the parser into unbounded recursion, exhaust the process call stack, and crash the process - an unauthenticated remote attacker can trigger this against storescp, dcmrecv, dcmqrscp, or any custom DICOM SCP built on the dcmdata library simply by sending a crafted dataset in a C-STORE request. Because the received dataset is parsed before any authentication or association-level trust decision occurs, no credentials or special conditions are required beyond network reachability of the DICOM listening port; the same crafted file also crashes local utilities such as dcmdump. Impact is limited to availability (stack exhaustion and process termination, with no code execution, data leakage, or integrity loss), and no public exploit code identified at time of analysis; the vendor has published an upstream fix that adds a configurable sequence nesting depth limit defaulting to 64.
Cross-site request forgery (CSRF) in the Gridbox extension for Joomla before 2.20.4.0 allows unauthenticated attackers to install arbitrary language packs by tricking a logged-in administrator (or any user with the core.tools permission) into visiting a crafted URL. The PagesController's addLanguage action fails to enforce the POST method, bypassing Joomla's session-token validation, which is only applied to POST requests. No public exploit code was identified at time of analysis; exploitation requires user interaction (the victim must be authenticated with core.tools).
Out-of-bounds write in IBM DataPower Gateway lets unauthenticated remote attackers corrupt process memory, resulting in disclosure of sensitive information and denial of service. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with a CVSS 3.1 base score of 8.6 driven by high availability impact alongside limited confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and IBM has made a fix available through its support advisory, so this is a credible operational priority rather than a confirmed emergency - exposure depends on whether the gateway's network listeners are reachable by the attacker.
An out-of-bounds write in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows an unauthenticated remote attacker to corrupt gateway memory, most reliably causing a denial of service and potentially enabling partial confidentiality or integrity compromise. The flaw carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), and the vector's PR:N/UI:N components confirm no credentials or user interaction are required to reach the vulnerable code - the practical limiting factor is whether the attacker's network can reach a DataPower service listener. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix via IBM Support (node/7289775).