Authenticated code injection in Brocade ASCG before 3.5.0 allows network-adjacent attackers with low-privilege accounts to execute arbitrary code on the server by submitting crafted configuration form data that is evaluated before validation. The vendor CVSS 4.0 base score is 8.6 (High), and no public exploit identified at time of analysis. Exploitation requires a valid account and network adjacency, not anonymous Internet access.
Missing authentication in the Brocade ASCG data collector API endpoint allows an unauthenticated adjacent-network attacker to instruct the appliance to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning it into a proxy or execution vector. Affected versions are those before 3.5.0; the vulnerability has a CVSS 4.0 score of 8.6 (AV:A/PR:N/UI:N) but requires network reachability to the service, and no public exploit identified at time of analysis.
Path traversal in the HTTP service component of Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 allows an unauthenticated attacker positioned on the same local or adjacent network segment to send a manipulated API request that escapes intended path restrictions and performs arbitrary file read or file write operations (the description also references file deletion, although the assessed impact is high confidentiality and integrity with no availability effect). The flaw is exploitable without credentials or user interaction in default configurations of affected releases, but only from an adjacent network - it is not reachable from the public internet without first obtaining such a position. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score accompanied the available intelligence.
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. By sending crafted API requests with oversized array counts or string lengths, an attacker can cause memory corruption, leading to a denial of service (daemon crash) or potentially arbitrary code execution within the management process. There is no public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 8.6) and requires only low-privileged REST API credentials and network adjacency.
Authentication bypass in Brocade ASCG versions prior to 3.5.0 allows unauthenticated attackers on an adjacent network to fully compromise the SupportLink API component due to a hard-coded cryptographic key (CWE-321) shared across all deployments. Exploitation requires adjacent network access and recovery of the key, but no public exploit code has been identified at time of analysis. The vendor has released version 3.5.0 to address the flaw.
Arbitrary code execution in Obsidian Desktop builds prior to 1.14.0 is possible when a user opens an attacker-supplied Markdown note and manually starts it as a presentation: a crafted data-background-iframe attribute survives DOMPurify sanitization in the bundled Slides core plugin, and Reveal.js then promotes that value into an iframe src without URL-scheme validation, allowing a javascript: payload to reach Node.js APIs through parent.require in Obsidian's Node-integrated, context-isolation-disabled renderer. The attacker is unauthenticated per the assessed vectors (PR:N) but exploitation is entirely local and user-driven, requiring file-based delivery plus two deliberate user actions (opening the note and launching the presentation), which is why the assessed CVSS 3.1 score is 8.5 with S:C. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published a patched release, so exposure is eliminated by updating.
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying an arbitrary fabric identifier that is never validated against the caller's authorization scope, allowing unauthorized cross-fabric operations and disclosure of configuration details belonging to tenants or Virtual Fabrics they were not granted access to. Affected builds are Fabric OS releases before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires an adjacent/management-network position (AV:A) plus valid credentials (PR:L) in an environment where multiple tenants actually share the switch; single-fabric deployments with no tenant separation offer nothing to cross into. Impact is confined to confidentiality and integrity of other fabrics' configuration with no availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing.
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's management service or potentially achieve arbitrary code execution by sending a crafted trunk configuration request through the REST API that is padded with an excessive number of list delimiters. The affected code path copies delimiter-separated list strings into a dynamically allocated heap array without validating the maximum number of elements, so a request that overruns the allocation corrupts heap metadata. Exploitation requires high-level (administrator) credentials and adjacent-network reachability to the management interface - a combination that realistically narrows the threat population to malicious insiders or attackers already holding or abusing admin credentials - and no public exploit code has been identified at time of analysis. This is a genuine but conditional priority rather than a drop-everything emergency.
Argument injection in WP Toolkit for cPanel allows local, low-privilege users with a valid hosting account to execute arbitrary code as other accounts on the same server. The vulnerability requires a multi-tenant deployment where untrusted local accounts coexist with WP Toolkit, as it is not remotely exploitable and needs no victim interaction. No public exploit code has been identified, but its high impact makes it a mid-to-high priority for shared and reseller hosting providers to patch promptly.
Arbitrary operating system command execution is possible in the AWS databases-on-aws agent plugin (part of awslabs/agent-plugins) versions before 1.7.1, because its psql-connect.sh helper fails to reject psql backslash meta-commands such as \! when sanitizing the --command value. An unauthenticated attacker who can influence a database command value reaching the agent context (per the CVSS 4.0 vector, PR:N) can leverage meta-commands like \! to run local shell commands on the host running the helper, resulting in full confidentiality, integrity, and availability impact to that host; exploitation is local with passive user interaction (AV:L, UI:P), meaning it requires the plugin to be deployed and active and the operator/agent to actually invoke the --command path. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released the 1.7.1 fix together with AWS security bulletin 2026-130.
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to forge IPC storage callbacks and register an administrative web-management session without legitimate authentication. The flaw is CWE-306 (missing authentication for a critical function) and has a high severity score (CVSS 8.5, v4.0 AV:L/PR:L), but exploitation requires an existing local foothold on the switch rather than network access. No public exploit or KEV confirmation was identified at time of analysis.
Local privilege escalation in System Informer before 4.0.26241.138 allows an attacker who already holds a low-privilege foothold on a machine where the phsvc helper is running to reach privileged APIs over the SiSvcApiPort ALPC endpoint and execute code as SYSTEM. The pre-patch authorization check accepted any Authenticode-signed caller, so an attacker can load or inject code into a Microsoft-signed host such as rundll32.exe and invoke PhSvcApiCreateService without forging a signature; the attack is strictly local (AV:L) and requires System Informer to be installed and its helper service active, meaning this is a post-compromise escalation rather than an internet-facing emergency. The vendor has released a fix in 4.0.26241.138, and no public exploit identified at time of analysis.
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivileged local user to submit malformed logging configurations that inject arbitrary directives into the system logging daemon's configuration file. These directives execute with elevated privileges when the logging service reloads, enabling an attacker to gain root-level access on the switch. The vulnerability requires an existing low-privilege local account (PR:L) and no user interaction (UI:N); no public exploit has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact within the local scope.
Command injection in the security certificate management component of the Brocade Fabric OS administrative management API lets an authenticated attacker with high privileges execute arbitrary system commands with the rights of the underlying management daemon. Only Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected, and exploitation requires both adjacent-network reachability to the management API (AV:A, not routable internet-wide) and privileges sufficient to issue certificate deletion requests (PR:H), which materially limits real-world exposure despite the 8.5 CVSS score. No public exploit code or confirmed active exploitation was identified at time of analysis, and the attack does not require end-user interaction (UI:N).
Arbitrary operating-system command execution on Obsidian Desktop builds prior to 1.14.0 is possible when a victim opens an attacker-supplied note in Live Preview and clicks a malicious MathJax-rendered anchor. The flaw lives in the bundled MathJax 3.2.2 Safe component, whose filterURL mishandles a TAB byte embedded in a \href URL scheme, yielding an empty protocol that slips past the configured safeProtocols allowlist and renders a javascript: link; clicking it executes in the Node-integration-enabled renderer through require('child_process'), running commands as the desktop user. Exploitation is conditionally gated rather than a drive-by remote compromise: the attacker cannot act without the victim's click (UI:A / UI:R), the hostile note must first be delivered into the victim's vault (typically via a shared, synced, or downloaded vault or social engineering), and patched users or those with Node integration disabled are not affected; confirmed actively exploited status is not established - no public exploit identified at time of analysis - and the vendor patch is referenced in the desktop v1.14.4 changelog.
Authenticated administrative users of the Brocade Fabric OS configuration-management CLI can read arbitrary files on the switch's local operating system - including sensitive configuration files, password hashes and system secrets - by injecting unsanitized arguments through the search-pattern filter of configuration-viewing commands. The flaw is an argument-injection issue (CWE-88) affecting Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires a valid administrative CLI account (PR:H in the CVSS 4.0 vector, PR:L in the independent assessment) plus adjacent-network reachability to the management plane (AV:A); no unauthenticated or internet-facing exploitation path is indicated. Risk is genuine but conditional rather than a drop-everything emergency: no public exploit identified at time of analysis, no CISA KEV listing, and the assessed impact is predominantly confidentiality loss with a scope change (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), while the vendor-side score is 8.4 under CVSS 4.0.
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0.0 through 10.0.0a1) lets a high-privileged, authenticated administrator supply a crafted status-file path during a configuration transfer so that the underlying process relocates an arbitrary system file into a predictable, world-readable temporary directory. Successful exploitation yields high confidentiality and integrity impact on the switch - leaking sensitive configuration or credential material and destroying/misplacing critical system files - and can cause persistent denial of service, though the CVSS 4.0 vector (AV:A/PR:H, with no vulnerable-system availability impact scored) and the independent assessment agree the attack is confined to the management plane and requires both adjacent/management-network reach and a valid admin account. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied; the practical risk is access-gated rather than a drive-by or internet-facing threat, and segregated or already-patched management networks are not exposed.
Local code execution in SumatraPDF 3.6.1 and earlier on Windows is possible when a user opens an attacker-supplied document and then clicks a link inside a SumatraPDF notification popup, because untrusted text (the document path or a PDF link target) is fed into the notification renderer that interprets '(CmdFoo)' markup as a trusted command link. The injected link dispatches a CmdExec command through ExecuteTipLink(), letting the attacker run a chosen local program with the invoking user's own privileges - no elevation, but also no network exposure, since the malicious file must be opened locally and the injected link must be clicked (UI:R/UI:A, AV:L in both the vendor CVSS 4.0 score of 8.4 and our assessed CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). At time of analysis there is no vendor-released patched version; an upstream fix commit exists, and no public exploit code or KEV-listed active exploitation has been identified.
Brocade Active Support Connectivity Gateway (ASCG) builds prior to 3.5.0 embed a static cryptographic key inside shipped software binaries, so an attacker who already holds high-privilege local access to the appliance or obtains the binaries can extract that key and use it to decrypt management credentials stored at rest or to forge administrative synchronization messages that peer nodes accept. The vendor scores this High at CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), and the independent assessment concurs with a CVSS 3.1 base of AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H: the vector requires authenticated, high-privileged local access, so this is not a network-facing, unauthenticated path. No public exploit code has been identified and the flaw is not in CISA KEV, but the use of a single shared key across installations means any successful extraction has cross-deployment consequences; upgrading to ASCG 3.5.0 or later removes the condition.
Local credential theft in Brocade ASCG before 3.5.0 allows a low-privileged authenticated user on the ASCG VM to extract stored management credentials for onboarded SANnav instances by issuing requests into the SANnav host network namespace, enabling follow-on compromise of connected Brocade SANnav servers or managed Fibre Channel switches. The vulnerability is CWE-522 (insufficiently protected credentials) and requires an existing local foothold (CVSS vector AV:L/PR:L, no user interaction), so unauthenticated remote attackers cannot exploit it directly. No public exploit identified at time of analysis.
Stack-based buffer overflow in Poppler's Decrypt::revision6Hash() allows a caller-supplied password longer than 127 bytes for an AESV3/R6 (AES-256 revision 6) encrypted PDF to overwrite the K1 and E stack buffers, crashing the process and corrupting nearby memory. Poppler 0.42.0 through 26.10.0 is affected across libpoppler, libpoppler-glib and the C++ API, and the flaw is remotely reachable and unauthenticated per the assessed vector (CVSS:4.0 PR:N) but carries an explicit attack requirement - the attacker must control the password string passed to the decrypt routine - so realistic exposure is automated or server-side PDF pipelines that decrypt files with externally supplied passwords rather than interactive viewers where the user types the password. Impact is primarily availability (A:H) with a limited integrity effect (I:L); no public exploit identified at time of analysis, no CISA KEV confirmation of active exploitation, and an upstream fix is tracked via freedesktop GitLab merge request 2398 with a vendor advisory noted.
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 lets remote, unauthenticated attackers who can reach an XML-accepting endpoint read files or internal resources from the gateway host and, via entity expansion, exhaust memory. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) confirms no credentials or user interaction are required, with high confidentiality impact and low availability impact. There is no public exploit code and no indication of active exploitation, and IBM has published a patch through its support portal.
Heap-based buffer overflow (CWE-787) in IBM DataPower Gateway allows an unauthenticated remote attacker to crash the gateway and cause a denial of service. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, so any attacker who can reach a listening interface and deliver a crafted request to the vulnerable parsing path can trigger the fault. The assessed impact is availability-only (A:H, C:N/I:N) rated 8.2 High; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is governed mainly by network exposure of the gateway's listening interfaces. This is a genuine but tier-two priority issue rather than an emergency, with patches available from IBM.
Unauthenticated remote attackers can trigger a memory-safety fault in IBM DataPower Gateway that crashes the affected service, producing a denial-of-service condition; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, score 8.2) confirms network reachability with no authentication, no user interaction, and no unusual configuration required, while availability impact is High and there is a limited Confidentiality impact from potential leakage of adjacent memory. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. This issue is not confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis, but a vendor patch is available and the affected versions are frequently internet-facing, so prioritization should follow normal critical-exposure timelines rather than emergency response.
Denial of service in the MongoDB Go Driver can be triggered when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte BSON array supplied by an unauthenticated remote source, causing an out-of-bounds index and a runtime panic that may terminate the unprotected process. The CVE carries a CVSS 4.0 base score of 8.2, but our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects the prerequisite that the vulnerable Validate methods must be invoked on attacker-controlled raw BSON; applications that never call these methods on untrusted input or that recover from panics are not materially impacted. No public exploit identified at time of analysis, no confidentiality or integrity impact has been identified, and the realistic blast radius is availability of the specific unprotected process.
Malformed BSON bytes fed to the MongoDB Go Driver can trigger an integer overflow in the driver's BSON value-length handling (CWE-190) and cause a runtime panic; because an unrecovered Go panic terminates the process, an unauthenticated remote attacker who can control BSON input reaching an application's validation or value-access path can cause a denial of service. The exposure is genuine but bounded: the driver's own server-monitoring path already contains panic recovery and degrades only to a server-selection failure, and applications that wrap BSON parsing in their own recovery, or never pass untrusted BSON into the driver, are not affected. No public exploit code has been identified at time of analysis, and no EPSS score was provided in the source data.
Jivejdon through 5.0 stores account passwords as unsalted MD5 digests - computed by ToolsUtil.hash() and persisted through AccountDaoSql - so an attacker who obtains the user table can recover plaintext credentials offline with precomputed tables or GPU-accelerated cracking. The flaw is not self-contained: it requires a prior database compromise or a separate SQL injection to reach the credential table, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (vendor CVSS 4.0 rates it 8.2 with AC:H/AT:P), making this an impact amplifier rather than an initial-access vector. No public exploit code and no confirmed active exploitation of this password-storage weakness were identified at time of analysis, although the advisory carries an associated SQLi tag.
Information disclosure in Brocade SANnav before 2.4.0b and 3.0.0 occurs because the product writes encoded passwords and authentication tokens to log files, including the SANnav supportsave diagnostic bundle. An attacker who gains access to those logs or the supportsave output can recover secrets and potentially reuse them, though the description frames this as requiring an authenticated attacker with file-level access and the assessed vector reflects a local/authenticated prerequisite; the input CVSS 4.0 vector lists PR:N, a discrepancy that should be confirmed with the vendor. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Security-restriction bypass in IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 allows a remote authenticated attacker to have forged or tampered cryptographic signatures accepted by the gateway, defeating the trust checks those signatures are meant to enforce. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1), the attacker must already hold valid low-privilege credentials and have network reachability to the gateway, but no user interaction is required, and successful exploitation yields high confidentiality and integrity impact with no availability effect. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the primary limiting factor is the authentication prerequisite, which excludes fully unauthenticated external attackers.
Deeply nested GraphQL documents can crash PHP worker processes running the webonyx/graphql-php library in versions 15.32.2 and earlier, because the recursive-descent parser has no recursion depth limit and the resulting stack exhaustion becomes an uncatchable SIGSEGV. The flaw is remotely reachable unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 8.2) and the failure occurs during parsing, before query validation, depth analysis or complexity controls ever execute, so worker processes on PHP-FPM, Swoole, RoadRunner, ReactPHP or CLI runtimes are killed with no exception, log entry or recovery path. The vendor has released a fix in 15.32.3 that enables a default recursion limit of 256; there is no KEV listing and no public exploit identified at time of analysis, though the upstream advisory documents a minimal crashing payload of roughly 74 KB, which is below common HTTP body-size limits.
SQL injection in MariaDB Connector/Node.js (3.2.0 through 3.2.4, 3.3.x before 3.3.4, 3.4.x before 3.4.7, and 3.5.x before 3.5.4) allows an attacker-influenced object key containing a backtick to break out of the quoted identifier the driver builds when it expands object properties into a SQL SET clause, letting the remainder of the key be parsed as SQL so that columns the application never intended to expose can be updated or arbitrary statements appended with the database user's privileges. Exploitation is conditional and unauthenticated at the driver layer (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): the application must explicitly enable the non-default permitSetMultiParamEntries option and must pass object KEYS - not merely values - derived from attacker-influenced input into an expanded `SET ?` clause. No public exploit code or confirmed active exploitation was identified at time of analysis, and the limiting factors (off-by-default feature plus the need for attacker-controlled keys) are the reason the assessed vector carries AC:H; the serialized-object handling used when the option is disabled is not affected.
Out-of-bounds write in IBM DataPower Gateway lets a remote, unauthenticated attacker corrupt memory and potentially execute arbitrary code on affected gateway builds (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2), as reflected in the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and a base score of 8.1. The PR:N/UI:N components mean no credentials or user interaction are required, so any network-reachable instance on an affected build is exposed, though the AC:H rating indicates exploitation depends on satisfying a non-trivial condition - most likely a specific input state, parsing path, or memory layout - to escalate the write beyond a crash into reliable code execution. Vendor patch data indicates a fix is available from IBM, and no public exploit code or confirmed active exploitation was identified at time of analysis; the EPSS score was not provided in the underlying intelligence, so no probabilistic exploitation estimate can be quoted.
Authorization bypass in Apache DolphinScheduler before 3.4.3 allows an authenticated user to alter task definitions, together with their upstream dependencies, in projects they are not authorized to access. The attacker pairs a projectCode they legitimately belong to with a task-definition code belonging to a different project when calling the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint, because the handler never confirms that the task code actually belongs to the supplied project. Impact is confined to integrity and availability of workflow definitions (assessed vector I:H/A:L, C:N), so unauthorized projects may have their pipelines silently rewritten or disrupted; no public exploit code has been identified at time of analysis and EPSS is only 0.18% (7th percentile), making this a genuine but moderate-priority issue rather than an urgent emergency.
Authenticated users of Apache DolphinScheduler can stop or create savepoints for task instances belonging to projects they are not authorized to access, because the project-scoped task-instance API fails to enforce per-project authorization. The issue affects all releases before 3.4.3 and is reachable over the network via the /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop and /savepoint endpoints. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L (the vendor-published score is 8.1), meaning a valid authenticated account plus knowledge or enumeration of a target task instance ID is required - anonymous exploitation is not possible - and the practical impact is an integrity and limited availability concern in multi-tenant or multi-project deployments where project isolation is a security boundary; no public exploit code has been identified at time of analysis, EPSS is a low 0.16% (5th percentile), and the CVE is not in CISA KEV. This is a genuine but moderate-priority issue rather than a top-tier emergency.
Man-in-the-middle interception of TLS-protected communications in IBM Guardium Data Protection 12.2.2 is possible because the product does not properly validate certificates (CWE-295), allowing an attacker positioned on the network path to read and modify traffic that the software treats as trusted. The flaw is unauthenticated (CVSS 3.1 AV:N/AC:H/PR:N/UI:N) but not trivially automatable, since the attacker must first achieve an active interception position - the reason CISA SSVC rates exploitation as none and automatable as no, and the reason the assessed impact is limited to confidentiality and integrity (C:H/I:H/A:N) rather than availability. EPSS is very low at 0.14% (3rd percentile), no public exploit code has been identified, and the issue does not appear in CISA KEV; IBM has released a vendor patch, so the practical risk for most deployments is remediation-tracking rather than emergency response.
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.
Stack-based buffer overflow in IBM DataPower Gateway firmware tracks 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 allows an authenticated attacker holding administrative-level privileges to execute arbitrary code on the gateway. Exploitation is network reachable but gated by high attack complexity (AC:H), meaning the attacker depends on conditions they cannot fully control, such as a specific memory layout or parsing state, so a single deterministic trigger is not guaranteed; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); IBM has released patched builds via its support advisory.
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker execute script in the webmail origin with a victim's session if the victim decrypts a crafted S/MIME (from 6.3.2) or OpenPGP (from 6.3.4) message and opens a text/html attachment in a new tab. The webmail is only served when the non-default REST API is enabled, and the attack requires user interaction, so realistic risk is materially lower than the 8.0 CVSS score. No public exploit was identified at time of analysis, and the vendor released v6.3.6 as a fix.
Checksum verification bypass in the Go toolchain (cmd/go) versions 1.27.0 before 1.27.2 and before 1.26.9 allows a malicious Go project with a forged golang.org/toolchain go.sum entry, combined with a user-selected attacker-controlled GOMODPROXY, to substitute a tampered toolchain that cmd/go would otherwise reject. Exploitation requires local access and user interaction (CVSS 7.8, AV:L/UI:R) and two attacker-controlled preconditions the victim must opt into: operating inside the crafted project and using the malicious proxy. No public exploit code identified at time of analysis, and EPSS is 0.13% (2nd percentile), indicating low predicted exploitation likelihood.
Go toolchain (cmd/go) releases before 1.26.9 and 1.27.0 through 1.27.1 can be induced to substitute an attacker-controlled module in place of the bundled golang.org/fips140 dependency when a developer builds a project that ships a bogus golang.org/fips140 definition and connects the build to an attacker-operated GOMODPROXY. Successful abuse yields high confidentiality, integrity, and availability impact within the build environment because the toolchain fails to properly validate the module's integrity check value (CWE-354), so untrusted module content is accepted in place of the trusted bundled copy. Exploitation is conditional rather than widespread: it requires both an attacker-crafted project and explicit developer action to use a non-default, attacker-chosen proxy (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8), and no public exploit code or confirmed active exploitation has been identified at time of analysis, with EPSS at roughly 0.11% (1st percentile). Vendor patches are available in Go 1.26.9 and 1.27.2.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an attacker who already holds low-privilege local access on the appliance to recover the root password through the pkcrypto passkey component and thereby obtain full root control, because that component combines weak cryptographic protection with a hard-coded recovery key (CWE-798). The exposure is confined to a local attack path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no network or unauthenticated remote vector exists and the attacker must first establish a foothold on the appliance - realistically an insider or someone who has already compromised the host by other means. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the flaw as non-automatable while assigning total technical impact, and EPSS is 0.11% (1st percentile), so this is a serious but not urgent technical issue.
Local privilege escalation to root in the IBM Guardium Data Protection 12.2 patch installer, where a signature-verification bypass lets an attacker substitute a tampered or unsigned patch artifact that the installer then executes with root privileges. Exploitation requires local access to the appliance with at least low-level privileges (PR:L) and the ability to stage a malicious patch and win a timing window during installation; the assessed vector is AV:L/AC:H with a resulting base score of roughly 7.0, slightly below the vendor-published 7.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a patch; this is a credible but not emergency-tier priority given the local-only attack path, prerequisite foothold, and race-condition reliability constraints.
Local privilege escalation in Guardium Data Protection 12.2 allows an authenticated low-privileged local user to abuse the cp_wrapper component to gain root privileges and access or modify sensitive system files. The issue is not remotely exploitable (AV:L) and requires a pre-existing local foothold (PR:L), so it is most relevant to insider threats, compromised low-privileged accounts, and post-compromise escalation; no public exploit identified at time of analysis, and no CISA KEV confirmation was provided. IBM has released a vendor patch, and this is a credible but not emergency-tier priority.
Path traversal in decompress-zip through 0.3.3 allows a crafted ZIP archive to write files outside the intended extraction directory when a victim or application uses the package to extract it, potentially enabling arbitrary file overwrite, application compromise, or code execution in environments with a useful writable sibling path. The assessed vector is local (AV:L) with required user/application interaction (UI:R), no network exposure, and no special authentication (PR:N), so exploitation requires the attacker to deliver the archive into an extraction workflow; RCE is conditional, not guaranteed. No public exploit identified at time of analysis, and no CISA KEV active-exploitation report was provided; the overall risk is real but conditional rather than an urgent mass-exploitation threat.
Local privilege escalation in GlavSoft TightVNC Server for Windows before 2.8.88 allows an authenticated local user to execute arbitrary code with SYSTEM privileges by planting a malicious screenhooks32.dll or screenhooks64.dll where the TightVNC service will load it. DynamicLibrary::init() and ThemeLib call LoadLibrary() with bare file names and no LOAD_LIBRARY_SEARCH_* flags, so the service follows the default DLL search order and picks up an attacker-controlled copy from a writable directory that sits ahead of the legitimate file, such as an installation directory left with weak ACLs. Exploitation is constrained: it requires a pre-existing local session on the affected host plus a writable directory earlier in the search order, so it cannot be triggered remotely or unauthenticated; no public exploit identified at time of analysis.
Local privilege escalation in TightVNC Server for Windows before 2.8.88 allows an authenticated low-privileged user to tamper with the service's IPC channel, potentially gaining SYSTEM-level access, disclosing session data, or causing denial of service. The flaw stems from a named shared memory segment in the Global\ namespace created with a NULL DACL and a predictable time-seeded name, enabling any local process to open and modify pipe HANDLE values used between the TightVNC service and its desktop server process. No public exploit code has been identified at time of analysis, and exploitation requires a local authenticated session on a host actively running the vulnerable service as SYSTEM.
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any local authenticated user read the mail server's stored messages, logs, temporary files, and built-in database, because the data, log, temp, database and event folders and the hMailServer.INI file inherit the local Users group's read access from the default installation path under Program Files. The readable INI exposes the database password, which is protected only by the machine's DPAPI key and can therefore be unsealed by any local account - handing full control of an external database - while the built-in database's account password hashes become readable whenever the hMailServer service is stopped; the Linux AppImage 6.3.0 through 6.3.5 has a parallel weakness in per-user data folder permissions. Exploitation requires an untrusted local account able to sign in to the host, no public exploit was identified at time of analysis, and the vendor has released 6.3.6 as the fix.
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailServer account - crash the mail server service and potentially execute code in its LocalSystem security context by passing an over-long hexadecimal string to the unauthenticated COM method Utilities.BlowfishDecrypt, which copies input of arbitrary length into a fixed 255-byte heap buffer. Because exploitation requires an existing local login (CVSS AV:L/PR:L) and the only confirmed outcome is a service crash, this is an access-gated local privilege-escalation/denial-of-service issue rather than a remotely wormable emergency; no public exploit identified at time of analysis. Vendor fix is available in hMailServer 6.3.4, which contains the reference commit 135a1908ff820ed587d5f180f98c53bd010d8931.
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an interactive logon but no hMailServer credentials-to abuse COM objects to read and write arbitrary files as the service account and send mail as any sender. The service registers its COM classes without DCOM launch or access permissions and calls CoInitializeSecurity with a null security descriptor, so any user logged on at the console or over Remote Desktop can activate hMailServer.Message, Attachments, and hMailServer.FetchAccount objects. If the service runs as LocalSystem (the default), arbitrary file write can lead to code execution as SYSTEM; no public exploit identified at time of analysis.
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has code execution as the unprivileged hmailserver service account to run arbitrary code as root via the live-update apply helper (hmailserver-update). The vulnerability requires the live-update path unit to be active, which is the default for the project's .deb and .rpm packages and applies to AppImage installations run under that unit, but does not affect non-Linux builds. No public exploit code has been identified at time of analysis, and the vendor has released version 6.3.6 to address the issue.