Remote code execution in ILIAS LMS (before 9.24, 10.x before 10.12, and 11.x before 11.5) allows an authenticated user with test-question authoring rights to inject ImageMagick convert options through the filename of an uploaded image in an image-map question. Because escapeshellcmd() does not neutralise tab characters, an author can smuggle extra command arguments that instruct convert to drop a PHP file under the web root, which is then executable by any visitor and yields remote code execution on the server. Exploitation requires a tutor/instructor-level account with access to assImagemapQuestionGUI, no public exploit code has been identified at time of analysis, and a vendor patch is available.
Cross-site request forgery in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions) lets a remote attacker who lures a logged-in user into loading attacker-controlled content submit unauthorized, privileged state-changing requests through that victim's authenticated session; CVSS 3.1 rates it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attacker needs no credentials of their own, but successful abuse depends on a concurrently authenticated victim - most damagingly an administrator - plus a social-engineering/user-interaction step, so exposure is greatest where the management interface is internet-reachable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); a vendor patch is available per IBM's advisory.
Cross-site request forgery in the Melapress WP 2FA WordPress plugin, affecting all versions through 4.1.0, allows an attacker to make a logged-in privileged WordPress user - typically an administrator with access to the two-factor authentication settings - perform unintended state-changing WP 2FA actions by tricking them into visiting a malicious page or link while their session is active. The input CVSS 3.1 vector scores 8.8 (High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but an independent reassessment places integrity impact as the dominant concern (C:L/I:H/A:N), since exploitation is wholly dependent on a victim who is both authenticated and successfully lured into interaction (UI:R); no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing). Despite the high headline score, the practical attack surface is constrained by the required user interaction, a valid privileged session at the time of the lure, and the fact that the specific vulnerable endpoint and action are not disclosed in the available data; the underlying defect is a missing or inadequate anti-CSRF nonce check on a WP 2FA request in versions up to and including 4.1.0.
Authorization bypass in OctoCloud 1.12.06 lets an authenticated low-privilege user access functionality and data they should not be permitted to reach, because the application trusts a user-supplied key when making access-control decisions. Successful exploitation allows high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), though the attacker must already hold a valid low-privilege account - this is not a remote-unauthenticated flaw. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied; the vulnerable endpoint and parameter are not disclosed in the available TR-CERT advisory. Only the 1.12.06 release line up to (but not including) 1.12.07 is affected.
Authenticated OS command injection in the management interface and session-processing routines of Brocade Fabric OS allows a low-privilege Fabric OS account - or an attacker who controls a directory-service account trusted by the switch - to smuggle shell metacharacters into connection-validation and session-verification input and reach internal execution wrappers, running arbitrary operating-system commands with elevated privileges on the SAN switch. Only Fabric OS versions before 10.0.1 are affected, and exploitation requires network reachability to the management interface over an adjacent or management network plus prior authentication (CVSS:4.0 base 8.6; the independent assessment concurs on AV:A/PR:L/UI:N with high confidentiality, integrity and availability impact). No public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is best treated as an insider/lateral-movement risk on segmentation-exposed management planes rather than an opportunistic internet-facing emergency.
Brocade Fabric OS contains an OS command injection flaw in the REST API management interface that lets an authenticated, high-privileged administrator execute arbitrary commands as root on the underlying switch host by supplying shell metacharacters in SSH known-host configuration parameters. Affected deployments are Fabric OS releases before 9.2.2d and the 10.0.0 through 10.0.0a1 range; the vulnerability carries a CVSS v4.0 base score of 8.5 (High) and an equivalent CVSS v3.1 assessment of 8.5, with the practical risk tempered because an attacker must already hold administrative rights and reach the switch over an adjacent management network rather than the open Internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a constrained-priority issue for SAN administrators rather than an emergency patch-everything event.
Memory corruption in MongoDB libmongocrypt lets an authenticated actor who can modify key vault documents - or a malicious or compromised MongoDB server - crash or corrupt the memory of any client application that has Client-Side Field Level Encryption (CSFLE) or Queryable Encryption enabled. The trigger is a crafted key document containing duplicate masterKey fields, which causes provider-specific KMS data to be mis-typed during key-document cleanup, producing invalid memory access and invalid frees (CWE-843 type confusion). Scored 8.7 under CVSS 4.0, while our own assessment is more conservative at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H, placing the confirmed impact at client-side crash and memory corruption rather than proven remote code execution; no public exploit code identified at time of analysis, and exploitation requires that encryption be in use plus key-vault write privileges (PR:L) or a hostile server.
OS command injection in the WebTools administrative interface of Brocade Fabric OS lets an authenticated, high-privileged user execute arbitrary shell commands as root on the switch by supplying crafted parameter strings during configuration download or file-transfer operations that use remote server profiles. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation is gated by two hard prerequisites, namely an account already holding the specific config-download permission (PR:H) and adjacent-network reachability to the switch management interface (AV:A), with high confidentiality, integrity, and availability impact on the device (CVSS 4.0 base 8.5). There is no public exploit code and no active exploitation identified at time of analysis, so this is a genuine but conditionally-gated risk requiring privileged management-network access rather than a remotely reachable, drop-everything emergency.
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass in its HTTPS JSON API dispatcher that allows an attacker on the adjacent network to append an onboarding-scoped object to a JSON request and thereby skip session verification, invoking privileged actions without credentials. Successful exploitation can expose live video and audio, modify device settings, and disclose sensitive device information or secrets. The vendor has released patched firmware, no public exploit code was identified at time of analysis, and independent assessment rates the issue high severity under CVSS 3.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with the adjacent-network requirement the primary limiting factor.
Stack-based buffer overflow in the SNMP daemon of Brocade Fabric OS (all versions before 10.0.1) lets a remote, unauthenticated attacker crash or potentially execute code on affected switches by sending a specially crafted SNMPv3 packet. The flaw sits in an internal statistics handler that copies the attacker-supplied SNMPv3 context name into a fixed-size stack buffer without validating its length, producing memory corruption that the vendor says is reachable under default configuration. Per the assessed vector (AV:A/PR:N/UI:N, C/H/I/A:H), the attacker must be on an adjacent network segment with reachability to the switch's SNMP service (UDP/161) - a materially limiting factor, since switches with SNMP isolated on a dedicated management VLAN are much harder to hit - and no authentication or user interaction is required; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Incorrect authorization in Octopus Server causes the platform to evaluate multiple scoped permission assignments incorrectly, so an already-authenticated, highly privileged user can accumulate deployment permissions beyond those actually granted to them. This is an authenticated (PR:L) network-reachable flaw requiring a valid Octopus account that already holds scoped permission assignments; the realistic threat actor is a malicious insider or an attacker using a compromised legitimate account rather than an anonymous internet attacker, and no victim interaction is needed. With C:H/I:H/A:H, successful abuse can alter and deploy code across environments the user was never authorized to touch. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the 8.7 CVSS severity and default multi-scope evaluation behavior make it a priority for organizations relying on Octopus scoping for separation of duties.
Predictable pre-shared key generation in the TP-Link Tapo C325WB V2 camera's local media streaming service allows an unauthenticated attacker on the adjacent network to recover the key and authenticate to the stream without credentials. This enables access and takeover of live video and audio feeds, compromising confidentiality and integrity. The vulnerability is rated 8.7 (High) with no public exploit identified at time of analysis; a vendor firmware patch is available.
Unauthenticated control-plane takeover in the Brocade Active Support Connectivity Gateway (ASCG) HTTPS service allows a network-adjacent attacker to issue control commands, alter cluster state, and modify system configuration in every release before 3.5.0. The defect is a plain missing-authentication condition (CWE-306): no credentials, tokens, or user interaction are involved, and no non-default configuration is required, since the HTTPS control interface simply does not enforce authentication or access control on incoming requests. The principal limiting factor is reachability rather than exploit complexity - the vendor scores it CVSS 4.0 8.7 with AV:A/PR:N/UI:N (adjacent, unauthenticated, no user interaction), so the attacker must already have a foothold on the appliance's management or local network segment. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so urgency is driven by how widely the management interface is exposed on flat or loosely segmented networks.
Unauthenticated API access in Brocade ASCG (Active Support Connectivity Gateway) before version 3.5.0 lets an attacker on an adjacent network perform privileged administrative actions - reading sensitive system configuration mapping data, modifying managed device inventories, and changing operational settings - without presenting any credentials. The flaw is scored CVSS 8.7 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L) and is rooted in CWE-306, a missing authentication check for a critical function; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). The dominant constraint is reachability rather than skill: the attacker must be able to route to the ASCG administrative management/API interface from an adjacent or logically local segment, so deployments that place the appliance behind segmentation or firewalls are materially less exposed.
Command injection in the REST API management interface of Brocade Fabric OS allows an authenticated low-privileged user to execute arbitrary operating-system commands on the affected switch, giving high confidentiality and integrity impact to the attacked system while availability is not directly affected. Only Fabric OS releases before 10.0.1 are affected, and because the CVSS vector requires adjacent-network reachability (AV:A) plus valid credentials (PR:L), the practical attack path runs through the switch management VLAN or an equivalent segmented management plane rather than the public internet. Scoring 8.5, this is a genuinely serious but not top-tier remote-exploitation risk: no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so exposure is driven mainly by whether the REST API management interface is enabled and reachable from untrusted adjacent segments.
CPU exhaustion during SVG rendering in CairoSVG versions prior to 2.9.1 lets an unauthenticated remote attacker deny service to any application that converts untrusted SVG input. A path element containing a large number of segments drives quadratic (O(n²)) work in cairosvg/path.py, where the tokenizer repeatedly slices and rescans the remaining path data and draw_markers drains node.vertices with pop(0); a payload well under one megabyte is sufficient to consume substantial CPU. The svg2png, svg2pdf, and svg2ps APIs all reach the vulnerable code during ordinary rendering, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H with VC:N/VI:N) confirms this is a pure availability impact requiring no authentication or user interaction; no public exploit code has been identified at time of analysis. Risk is therefore concentrated in services that render user-supplied SVGs, while deployments that only process trusted, developer-authored SVG files are not meaningfully exposed.
OpenStack Mistral through 23.0.0 exposes an authenticated command-injection path in its std.ssh_proxied action: the caller-supplied proxy_command string is handed to paramiko.ProxyCommand() and executed as a local subprocess on the executor host under the Mistral service account, before any SSH connection to the gateway or target host is even attempted. Any authenticated project member who can reach the standard action-execution API can therefore run arbitrary OS commands on the Mistral executor, with the default configuration affected because std.ssh_proxied is permitted out of the box; deployments that explicitly disable or restrict that action are not impacted. Exploitation requires valid project credentials (PR:L, not anonymous), so the practical risk is privilege escalation and lateral movement from a low-privileged tenant account rather than unauthenticated compromise, and no public exploit code was identified at time of analysis.
Quadratic-time denial of service in league/commonmark 2.0.0 through 2.10.1 lets unauthenticated remote attackers exhaust PHP worker CPU by submitting a single large Markdown paragraph made of pipe-free lines that do not begin with a letter, which forces the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() to rescan the entire growing paragraph buffer on every line. Successfully exploited, this drives seconds to tens of seconds of single-core CPU per request that scales with the square of the input size, enough to saturate worker pools and deny service to other users. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis, though the attack is trivially derived from the published advisory; impact is limited to availability with no confidentiality or integrity effect, and only applications that render untrusted Markdown with the Table extension enabled are affected.
Deeply nested DICOM sequence (SQ) elements delivered to a DCMTK 3.7.0-based service drive the parser into unbounded recursion, exhaust the process call stack, and crash the process - an unauthenticated remote attacker can trigger this against storescp, dcmrecv, dcmqrscp, or any custom DICOM SCP built on the dcmdata library simply by sending a crafted dataset in a C-STORE request. Because the received dataset is parsed before any authentication or association-level trust decision occurs, no credentials or special conditions are required beyond network reachability of the DICOM listening port; the same crafted file also crashes local utilities such as dcmdump. Impact is limited to availability (stack exhaustion and process termination, with no code execution, data leakage, or integrity loss), and no public exploit code identified at time of analysis; the vendor has published an upstream fix that adds a configurable sequence nesting depth limit defaulting to 64.
Cross-site request forgery (CSRF) in the Gridbox extension for Joomla before 2.20.4.0 allows unauthenticated attackers to install arbitrary language packs by tricking a logged-in administrator (or any user with the core.tools permission) into visiting a crafted URL. The PagesController's addLanguage action fails to enforce the POST method, bypassing Joomla's session-token validation, which is only applied to POST requests. No public exploit code was identified at time of analysis; exploitation requires user interaction (the victim must be authenticated with core.tools).
Out-of-bounds write in IBM DataPower Gateway lets unauthenticated remote attackers corrupt process memory, resulting in disclosure of sensitive information and denial of service. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, with a CVSS 3.1 base score of 8.6 driven by high availability impact alongside limited confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and IBM has made a fix available through its support advisory, so this is a credible operational priority rather than a confirmed emergency - exposure depends on whether the gateway's network listeners are reachable by the attacker.
An out-of-bounds write in IBM DataPower Gateway (10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2) allows an unauthenticated remote attacker to corrupt gateway memory, most reliably causing a denial of service and potentially enabling partial confidentiality or integrity compromise. The flaw carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), and the vector's PR:N/UI:N components confirm no credentials or user interaction are required to reach the vulnerable code - the practical limiting factor is whether the attacker's network can reach a DataPower service listener. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix via IBM Support (node/7289775).
Authenticated code injection in Brocade ASCG before 3.5.0 allows network-adjacent attackers with low-privilege accounts to execute arbitrary code on the server by submitting crafted configuration form data that is evaluated before validation. The vendor CVSS 4.0 base score is 8.6 (High), and no public exploit identified at time of analysis. Exploitation requires a valid account and network adjacency, not anonymous Internet access.
Missing authentication in the Brocade ASCG data collector API endpoint allows an unauthenticated adjacent-network attacker to instruct the appliance to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning it into a proxy or execution vector. Affected versions are those before 3.5.0; the vulnerability has a CVSS 4.0 score of 8.6 (AV:A/PR:N/UI:N) but requires network reachability to the service, and no public exploit identified at time of analysis.
Path traversal in the HTTP service component of Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 allows an unauthenticated attacker positioned on the same local or adjacent network segment to send a manipulated API request that escapes intended path restrictions and performs arbitrary file read or file write operations (the description also references file deletion, although the assessed impact is high confidentiality and integrity with no availability effect). The flaw is exploitable without credentials or user interaction in default configurations of affected releases, but only from an adjacent network - it is not reachable from the public internet without first obtaining such a position. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score accompanied the available intelligence.
Authenticated attackers with access to the adjacent management network can exploit stack-based buffer overflows in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. By sending crafted API requests with oversized array counts or string lengths, an attacker can cause memory corruption, leading to a denial of service (daemon crash) or potentially arbitrary code execution within the management process. There is no public exploit identified at time of analysis, but the vulnerability is high severity (CVSS 8.6) and requires only low-privileged REST API credentials and network adjacency.
Authentication bypass in Brocade ASCG versions prior to 3.5.0 allows unauthenticated attackers on an adjacent network to fully compromise the SupportLink API component due to a hard-coded cryptographic key (CWE-321) shared across all deployments. Exploitation requires adjacent network access and recovery of the key, but no public exploit code has been identified at time of analysis. The vendor has released version 3.5.0 to address the flaw.
Arbitrary code execution in Obsidian Desktop builds prior to 1.14.0 is possible when a user opens an attacker-supplied Markdown note and manually starts it as a presentation: a crafted data-background-iframe attribute survives DOMPurify sanitization in the bundled Slides core plugin, and Reveal.js then promotes that value into an iframe src without URL-scheme validation, allowing a javascript: payload to reach Node.js APIs through parent.require in Obsidian's Node-integrated, context-isolation-disabled renderer. The attacker is unauthenticated per the assessed vectors (PR:N) but exploitation is entirely local and user-driven, requiring file-based delivery plus two deliberate user actions (opening the note and launching the presentation), which is why the assessed CVSS 3.1 score is 8.5 with S:C. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published a patched release, so exposure is eliminated by updating.
An authenticated, low-privileged user in one Virtual Fabric on a Brocade Fabric OS switch can submit a request carrying an arbitrary fabric identifier that is never validated against the caller's authorization scope, allowing unauthorized cross-fabric operations and disclosure of configuration details belonging to tenants or Virtual Fabrics they were not granted access to. Affected builds are Fabric OS releases before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires an adjacent/management-network position (AV:A) plus valid credentials (PR:L) in an environment where multiple tenants actually share the switch; single-fabric deployments with no tenant separation offer nothing to cross into. Impact is confined to confidentiality and integrity of other fabrics' configuration with no availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing.
Heap corruption in Brocade Fabric OS before 10.0.1 allows an authenticated administrator to crash a SAN switch's management service or potentially achieve arbitrary code execution by sending a crafted trunk configuration request through the REST API that is padded with an excessive number of list delimiters. The affected code path copies delimiter-separated list strings into a dynamically allocated heap array without validating the maximum number of elements, so a request that overruns the allocation corrupts heap metadata. Exploitation requires high-level (administrator) credentials and adjacent-network reachability to the management interface - a combination that realistically narrows the threat population to malicious insiders or attackers already holding or abusing admin credentials - and no public exploit code has been identified at time of analysis. This is a genuine but conditional priority rather than a drop-everything emergency.
Argument injection in WP Toolkit for cPanel allows local, low-privilege users with a valid hosting account to execute arbitrary code as other accounts on the same server. The vulnerability requires a multi-tenant deployment where untrusted local accounts coexist with WP Toolkit, as it is not remotely exploitable and needs no victim interaction. No public exploit code has been identified, but its high impact makes it a mid-to-high priority for shared and reseller hosting providers to patch promptly.
Arbitrary operating system command execution is possible in the AWS databases-on-aws agent plugin (part of awslabs/agent-plugins) versions before 1.7.1, because its psql-connect.sh helper fails to reject psql backslash meta-commands such as \! when sanitizing the --command value. An unauthenticated attacker who can influence a database command value reaching the agent context (per the CVSS 4.0 vector, PR:N) can leverage meta-commands like \! to run local shell commands on the host running the helper, resulting in full confidentiality, integrity, and availability impact to that host; exploitation is local with passive user interaction (AV:L, UI:P), meaning it requires the plugin to be deployed and active and the operator/agent to actually invoke the --command path. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released the 1.7.1 fix together with AWS security bulletin 2026-130.
Authentication bypass in Brocade Fabric OS 9.2.2d and 10.0.0 through 10.0.0a1 allows a local low-privileged process to forge IPC storage callbacks and register an administrative web-management session without legitimate authentication. The flaw is CWE-306 (missing authentication for a critical function) and has a high severity score (CVSS 8.5, v4.0 AV:L/PR:L), but exploitation requires an existing local foothold on the switch rather than network access. No public exploit or KEV confirmation was identified at time of analysis.
Local privilege escalation in System Informer before 4.0.26241.138 allows an attacker who already holds a low-privilege foothold on a machine where the phsvc helper is running to reach privileged APIs over the SiSvcApiPort ALPC endpoint and execute code as SYSTEM. The pre-patch authorization check accepted any Authenticode-signed caller, so an attacker can load or inject code into a Microsoft-signed host such as rundll32.exe and invoke PhSvcApiCreateService without forging a signature; the attack is strictly local (AV:L) and requires System Informer to be installed and its helper service active, meaning this is a post-compromise escalation rather than an internet-facing emergency. The vendor has released a fix in 4.0.26241.138, and no public exploit identified at time of analysis.
Local privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an unprivileged local user to submit malformed logging configurations that inject arbitrary directives into the system logging daemon's configuration file. These directives execute with elevated privileges when the logging service reloads, enabling an attacker to gain root-level access on the switch. The vulnerability requires an existing low-privilege local account (PR:L) and no user interaction (UI:N); no public exploit has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact within the local scope.
Command injection in the security certificate management component of the Brocade Fabric OS administrative management API lets an authenticated attacker with high privileges execute arbitrary system commands with the rights of the underlying management daemon. Only Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are affected, and exploitation requires both adjacent-network reachability to the management API (AV:A, not routable internet-wide) and privileges sufficient to issue certificate deletion requests (PR:H), which materially limits real-world exposure despite the 8.5 CVSS score. No public exploit code or confirmed active exploitation was identified at time of analysis, and the attack does not require end-user interaction (UI:N).
Arbitrary operating-system command execution on Obsidian Desktop builds prior to 1.14.0 is possible when a victim opens an attacker-supplied note in Live Preview and clicks a malicious MathJax-rendered anchor. The flaw lives in the bundled MathJax 3.2.2 Safe component, whose filterURL mishandles a TAB byte embedded in a \href URL scheme, yielding an empty protocol that slips past the configured safeProtocols allowlist and renders a javascript: link; clicking it executes in the Node-integration-enabled renderer through require('child_process'), running commands as the desktop user. Exploitation is conditionally gated rather than a drive-by remote compromise: the attacker cannot act without the victim's click (UI:A / UI:R), the hostile note must first be delivered into the victim's vault (typically via a shared, synced, or downloaded vault or social engineering), and patched users or those with Node integration disabled are not affected; confirmed actively exploited status is not established - no public exploit identified at time of analysis - and the vendor patch is referenced in the desktop v1.14.4 changelog.
Stored cross-site scripting in Indico event management system before 3.3.13 lets authenticated users with content-creation privileges, such as speakers who can create minutes, store crafted HTML in event minutes. The script executes in a victim's browser only when a second privileged user makes concurrent edits to the same minutes, triggering the minute editor's conflict-resolution UI that renders the unsanitized payload. No public exploit has been identified at time of analysis, and the vendor rated the risk as relatively low due to the collaboration and privilege prerequisites.
Authenticated administrative users of the Brocade Fabric OS configuration-management CLI can read arbitrary files on the switch's local operating system - including sensitive configuration files, password hashes and system secrets - by injecting unsanitized arguments through the search-pattern filter of configuration-viewing commands. The flaw is an argument-injection issue (CWE-88) affecting Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1, and exploitation requires a valid administrative CLI account (PR:H in the CVSS 4.0 vector, PR:L in the independent assessment) plus adjacent-network reachability to the management plane (AV:A); no unauthenticated or internet-facing exploitation path is indicated. Risk is genuine but conditional rather than a drop-everything emergency: no public exploit identified at time of analysis, no CISA KEV listing, and the assessed impact is predominantly confidentiality loss with a scope change (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), while the vendor-side score is 8.4 under CVSS 4.0.
An arbitrary file-move flaw in the WebTools management interface of Brocade Fabric OS (all builds before 9.2.2d and 10.0.0 through 10.0.0a1) lets a high-privileged, authenticated administrator supply a crafted status-file path during a configuration transfer so that the underlying process relocates an arbitrary system file into a predictable, world-readable temporary directory. Successful exploitation yields high confidentiality and integrity impact on the switch - leaking sensitive configuration or credential material and destroying/misplacing critical system files - and can cause persistent denial of service, though the CVSS 4.0 vector (AV:A/PR:H, with no vulnerable-system availability impact scored) and the independent assessment agree the attack is confined to the management plane and requires both adjacent/management-network reach and a valid admin account. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied; the practical risk is access-gated rather than a drive-by or internet-facing threat, and segregated or already-patched management networks are not exposed.
Local code execution in SumatraPDF 3.6.1 and earlier on Windows is possible when a user opens an attacker-supplied document and then clicks a link inside a SumatraPDF notification popup, because untrusted text (the document path or a PDF link target) is fed into the notification renderer that interprets '(CmdFoo)' markup as a trusted command link. The injected link dispatches a CmdExec command through ExecuteTipLink(), letting the attacker run a chosen local program with the invoking user's own privileges - no elevation, but also no network exposure, since the malicious file must be opened locally and the injected link must be clicked (UI:R/UI:A, AV:L in both the vendor CVSS 4.0 score of 8.4 and our assessed CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). At time of analysis there is no vendor-released patched version; an upstream fix commit exists, and no public exploit code or KEV-listed active exploitation has been identified.
Brocade Active Support Connectivity Gateway (ASCG) builds prior to 3.5.0 embed a static cryptographic key inside shipped software binaries, so an attacker who already holds high-privilege local access to the appliance or obtains the binaries can extract that key and use it to decrypt management credentials stored at rest or to forge administrative synchronization messages that peer nodes accept. The vendor scores this High at CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), and the independent assessment concurs with a CVSS 3.1 base of AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H: the vector requires authenticated, high-privileged local access, so this is not a network-facing, unauthenticated path. No public exploit code has been identified and the flaw is not in CISA KEV, but the use of a single shared key across installations means any successful extraction has cross-deployment consequences; upgrading to ASCG 3.5.0 or later removes the condition.
Local credential theft in Brocade ASCG before 3.5.0 allows a low-privileged authenticated user on the ASCG VM to extract stored management credentials for onboarded SANnav instances by issuing requests into the SANnav host network namespace, enabling follow-on compromise of connected Brocade SANnav servers or managed Fibre Channel switches. The vulnerability is CWE-522 (insufficiently protected credentials) and requires an existing local foothold (CVSS vector AV:L/PR:L, no user interaction), so unauthenticated remote attackers cannot exploit it directly. No public exploit identified at time of analysis.
Stack-based buffer overflow in Poppler's Decrypt::revision6Hash() allows a caller-supplied password longer than 127 bytes for an AESV3/R6 (AES-256 revision 6) encrypted PDF to overwrite the K1 and E stack buffers, crashing the process and corrupting nearby memory. Poppler 0.42.0 through 26.10.0 is affected across libpoppler, libpoppler-glib and the C++ API, and the flaw is remotely reachable and unauthenticated per the assessed vector (CVSS:4.0 PR:N) but carries an explicit attack requirement - the attacker must control the password string passed to the decrypt routine - so realistic exposure is automated or server-side PDF pipelines that decrypt files with externally supplied passwords rather than interactive viewers where the user types the password. Impact is primarily availability (A:H) with a limited integrity effect (I:L); no public exploit identified at time of analysis, no CISA KEV confirmation of active exploitation, and an upstream fix is tracked via freedesktop GitLab merge request 2398 with a vendor advisory noted.
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 lets remote, unauthenticated attackers who can reach an XML-accepting endpoint read files or internal resources from the gateway host and, via entity expansion, exhaust memory. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) confirms no credentials or user interaction are required, with high confidentiality impact and low availability impact. There is no public exploit code and no indication of active exploitation, and IBM has published a patch through its support portal.
Heap-based buffer overflow (CWE-787) in IBM DataPower Gateway allows an unauthenticated remote attacker to crash the gateway and cause a denial of service. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, so any attacker who can reach a listening interface and deliver a crafted request to the vulnerable parsing path can trigger the fault. The assessed impact is availability-only (A:H, C:N/I:N) rated 8.2 High; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is governed mainly by network exposure of the gateway's listening interfaces. This is a genuine but tier-two priority issue rather than an emergency, with patches available from IBM.
Unauthenticated remote attackers can trigger a memory-safety fault in IBM DataPower Gateway that crashes the affected service, producing a denial-of-service condition; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, score 8.2) confirms network reachability with no authentication, no user interaction, and no unusual configuration required, while availability impact is High and there is a limited Confidentiality impact from potential leakage of adjacent memory. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. This issue is not confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis, but a vendor patch is available and the affected versions are frequently internet-facing, so prioritization should follow normal critical-exposure timelines rather than emergency response.
Denial of service in the MongoDB Go Driver can be triggered when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte BSON array supplied by an unauthenticated remote source, causing an out-of-bounds index and a runtime panic that may terminate the unprotected process. The CVE carries a CVSS 4.0 base score of 8.2, but our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects the prerequisite that the vulnerable Validate methods must be invoked on attacker-controlled raw BSON; applications that never call these methods on untrusted input or that recover from panics are not materially impacted. No public exploit identified at time of analysis, no confidentiality or integrity impact has been identified, and the realistic blast radius is availability of the specific unprotected process.
Malformed BSON bytes fed to the MongoDB Go Driver can trigger an integer overflow in the driver's BSON value-length handling (CWE-190) and cause a runtime panic; because an unrecovered Go panic terminates the process, an unauthenticated remote attacker who can control BSON input reaching an application's validation or value-access path can cause a denial of service. The exposure is genuine but bounded: the driver's own server-monitoring path already contains panic recovery and degrades only to a server-selection failure, and applications that wrap BSON parsing in their own recovery, or never pass untrusted BSON into the driver, are not affected. No public exploit code has been identified at time of analysis, and no EPSS score was provided in the source data.
Jivejdon through 5.0 stores account passwords as unsalted MD5 digests - computed by ToolsUtil.hash() and persisted through AccountDaoSql - so an attacker who obtains the user table can recover plaintext credentials offline with precomputed tables or GPU-accelerated cracking. The flaw is not self-contained: it requires a prior database compromise or a separate SQL injection to reach the credential table, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (vendor CVSS 4.0 rates it 8.2 with AC:H/AT:P), making this an impact amplifier rather than an initial-access vector. No public exploit code and no confirmed active exploitation of this password-storage weakness were identified at time of analysis, although the advisory carries an associated SQLi tag.