Cross-site scripting in the IBM DataPower Gateway 10.6.0 Web UI (builds 10.6.0.0 through 10.6.0.10) lets an unauthenticated attacker inject arbitrary JavaScript that executes in the browser of an operator who is already logged into the appliance management console, potentially leading to credential or session disclosure within that trusted session. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3) confirms the attacker needs no credentials but the victim must interact with attacker-supplied content, so this is a lure-driven, high-impact issue rather than silent mass exploitation; no public exploit has been identified at time of analysis. A vendor patch is available, and only the 10.6.0.x range up to 10.6.0.10 is affected, so upgrading the fixed build removes exposure.
IBM Guardium Data Protection 12.1 and 12.2.2 contain a path traversal flaw (CWE-22) that lets a remote, unauthenticated attacker delete arbitrary files on the appliance by supplying traversal-laden input to an affected file-handling function, giving a high-integrity and availability impact with no confidentiality exposure (CVSS 3.1: 9.1, AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:H). No public exploit code has been identified at time of analysis, EPSS is low at 0.36% (28th percentile), and CISA's SSVC decision framework rates exploitation as 'none' with a total technical impact, so this reads as a serious but not emergency-priority issue. Practical risk is bounded by reachability: Guardium is a management-plane appliance normally confined to privileged database and security administrators behind the enterprise perimeter, which narrows the realistic attacker population despite the network-vector rating.
Unauthenticated server-side request forgery and missing authorization in Dromara Skyeye let remote attackers drive the server to fetch attacker-chosen internal URLs and overwrite any user's stored file through the OnlyOffice save callback editUploadOfficeFileById, then retrieve the modified content via queryFileToShowById. The flaw carries a CVSS 4.0 base score of 9.1 (PR:N, UI:N), although the assessed high attack complexity (AC:H/AT:P) reflects that a valid file id/key and an active OnlyOffice document-editing/callback flow are likely prerequisites, and SSRF reach is bounded by what internal addresses the server can resolve. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis.
Authentication bypass in HPE Intelligent Management Center (iMC) prior to v7.3 E0713 lets unauthenticated remote attackers reach functionality that should require a valid login, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector, with high impact on confidentiality and integrity (C:H/I:H/A:N) and no reported availability impact. Any iMC instance running a build older than v7.3 E0713 and reachable over the network is exposed, and because iMC is an enterprise network management platform, compromise can expose managed-device credentials and configuration data and allow unauthorized changes. No public exploit code was identified at time of analysis and the CVE is not confirmed as actively exploited (CISA KEV), though the vendor advisory and the 9.1 base score warrant urgent patching on internet- or broadly reachable deployments.
Unauthenticated attackers can recursively delete arbitrary directories - including the WordPress installation root - on sites running the Super Forms - Drag & Drop Form Builder plugin for WordPress in all versions up to and including 6.3.316. The flaw is reachable by sending crafted JSON field declarations to the submit_form function that are not validated against the actual form schema, and it is compounded by an ABSPATH guard that dirname() trivially defeats by stripping the trailing slash. Exploitation is remote, unauthenticated (PR:N) and requires no user interaction, but is gated by a configuration prerequisite: an administrator must have enabled the documented 'Delete files from server after form submissions' setting, without which the vulnerable deletion code path is never reached; no public exploit identified at time of analysis.
An out-of-bounds read in the TDS7 LOGIN7 protocol parser of IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows unauthenticated remote attackers to deliver a crafted LOGIN7 packet with invalid offset or length values, causing denial of service and limited memory disclosure. The published CVSS 3.1 score is 9.1, but our independent assessment reduces confidentiality to Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H), and with EPSS at only 0.29% (20th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world priority is lower than the headline score suggests even though technical impact is rated total. The dominant limiting factor is network reachability: only deployments whose TDS/database-interception listener is exposed to untrusted networks are practically at risk.
Signals conflict: the original CVSS rates integrity and availability impact as high (9.1), but independent assessment determines only low availability impact. A logic error in Go's HTTP/2 server allows unauthenticated remote attackers to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection) by resetting streams to trigger a double refund of flow control credit. The practical impact is limited because total buffered data remains bounded by concurrent stream limits and stream-level flow control; no public exploit identified at time of analysis, and patches are available as upstream commits.
Remote, unauthenticated account takeover is possible in MyRezzta (AKIN Software) versions 2.06.03 through 2.07.00 because the application's forgotten-password recovery mechanism is implemented weakly (CWE-640). Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, an attacker who can reach the account-recovery endpoint needs no credentials, no user interaction, and no special configuration, and can gain high confidentiality and integrity impact - effectively seizing control of targeted user accounts - with no availability impact. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, but the flaw is rated 9.1 and was reported by TR-CERT; the practical risk is concentrated on internet-exposed MyRezzta deployments within the affected version range.
Argument injection in Infoblox NIOS troubleshooting commands allows an authenticated high-privilege administrator to escalate to root-level shell access on the appliance. The flaw resides in the maintenance-mode diagnostic interface where user-supplied arguments are passed to underlying system commands without proper sanitization, and exploitation requires a pre-existing administrative credential (PR:H) rather than being reachable by anonymous or low-privilege users. No public exploit code or confirmed active exploitation was identified at time of analysis, and realistic risk is confined to malicious insiders or attackers who have already compromised NIOS admin credentials.
Unauthenticated remote attackers can trigger a use-after-free in IBM DataPower Gateway, resulting in a denial of service and potential disclosure of sensitive information held in freed memory. The flaw affects the 10.5.0 branch (10.5.0.0 through 10.5.0.22), the 10.6.0 branch (10.6.0.0 through 10.6.0.10), the 10.6CD/10.6.1 branch (10.6.1 through 10.6.6), and the 11.0.0 branch (11.0.0.0 through 11.0.0.2); the CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:H) rates it 9.1, but exploitation requires the gateway endpoint to be network-reachable and, as a memory-safety bug, reliable triggering typically depends on request sequencing and allocator/timing state. There is no public exploit identified at time of analysis, EPSS is low at 0.24% (14th percentile), and CISA's SSVC framework records exploitation as none and automatable as no - signals are therefore mixed between a high headline severity score and a low observed exploitation likelihood. A vendor patch is available per IBM's advisory.
Out-of-bounds memory handling in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2) allows network attackers to trigger a buffer overflow that can disclose sensitive process memory or crash the appliance. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), exploitation is unauthenticated and requires no user interaction, with high confidentiality and availability impact but no integrity impact - consistent with the CWE-125 out-of-bounds read classification rather than a write-based code-execution primitive. No public exploit code was identified at time of analysis, CISA SSVC records exploitation as 'none' and automation as 'no', and EPSS is low at 0.22% (12th percentile); note that the vendor's own 9.8 rating assumes full C/I/A impact, which this assessment does not corroborate. Patch available per vendor advisory (IBM support page node/7289775).
Unauthenticated path traversal in the Ollama `/api/pull` endpoint lets a remote attacker write an arbitrary file outside the model store by submitting a crafted path-traversal sequence in the layer digest field, because the `digestToPath` function does not adequately validate digests before constructing a filesystem path. When the Ollama process can write to `/usr/lib/ollama` (described as the default in most Ollama Docker images) and the server or container is subsequently restarted, the planted binary is loaded and executed, yielding remote code execution as root; the same file-write primitive is available without authentication to anyone who can reach the API. The issue is fixed in Ollama 0.35.0, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none', and no EPSS score was supplied in the source data. Real-world risk is high but conditional: exploitation of the full RCE chain depends on write access to `/usr/lib/ollama` and a restart, so deployments not using the default Docker image, running Ollama as a non-privileged user without write access to that directory, or not exposing the API to untrusted networks face substantially reduced exposure.