Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail delivery by sending messages crafted to look like RFC 3464 delivery status notifications or RFC 5965 abuse feedback reports whose returned-headers part begins with a very large number of blank lines. The DSN and ARF readers strip leading blank lines two bytes at a time, copying the remainder of the part on each iteration, so processing cost grows with the square of the blank-line count; a single report-shaped message within the reader's 2 MB limit can occupy a delivery thread for over a minute, and a few such messages per minute can saturate every delivery thread. Exploitation is conditional: the server must have bounce processing or complaint processing enabled, or must manage a mailing list, and the vendor states none of these is enabled by default, so a stock 6.3.4/6.3.5 installation is not exposed. There is no public exploit identified at time of analysis, no CISA KEV listing, and the impact is limited to availability of mail delivery (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no data exposure or code execution; the vendor-released fix is hMailServer 6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail delivery and SMTP service by sending a single crafted message. The root cause is inefficient algorithmic complexity (CWE-407) in inbound DKIM and ARC signature verification: assembling the canonical header and resolving the header names listed in a signature's h= tag grows quadratically with header size, so a message with very many header fields - or one field folded over very many continuation lines - holds a worker thread busy for tens of seconds per signature, and up to ten signatures are evaluated per message by both the DKIM and DMARC tests on the threads that serve delivery and SMTP. CVSS 3.1 rates this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity impact; no confirmed active exploitation (CISA KEV) or public exploit code was identified at time of analysis, and the vendor has published a fixed release, v6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make SMTP, IMAP, POP3, delivery, and REST API services unavailable by sending a crafted message. A non-terminating MIME header parsing loop pins a worker thread at full CPU until restart, but that path is only reached when the attachment blocker is configured to rename a blocked attachment or when a filename is set via the REST API; a broader quadratic-complexity path in RFC 2047/RFC 2231 header handling and repeated header deletion is reachable on default mail intake. No public exploit identified at time of analysis; vendor patch is version 6.3.6.
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first instance of each duplicated member name by rescanning the members already read, so an object with N distinct names costs O(N²) - roughly 8.9 seconds for a 1 MB payload and 300 seconds for 4 MB against the affected code. An unauthenticated remote attacker can reach this reader by mailing a crafted TLS-RPT report (compressed, expanding to as much as 16 MB after decompression) to a hosted domain's published report mailbox, where it is parsed on a delivery thread; with only ten delivery threads by default, a few such reports stall all mail delivery, both local and outbound, for over an hour per report. A signed-in webmail user can deliver the same 16 MB body through the webmail's own REST routes, holding the REST API worker threads instead. There is no confirmation of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; note that unauthenticated exploitation is confined to deployments that publish a TLS-RPT report mailbox, because where none is configured the unauthenticated REST sign-in routes that read JSON are capped at 64 KB and are not affected.
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 lets a remote peer stall outbound mail delivery by accepting a TCP/TLS connection and then sending nothing. Socket timeouts are applied in the form the Windows stack accepts but Linux refuses, and the server's HTTPS clients (MTA-STS, DANE TLSA, OAuth2, ACME) read without a deadline, so an attacker can pin worker threads indefinitely and stop delivery, ManageSieve, and metrics service for everyone else. The MTA-STS policy fetch is enabled by default and is performed during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound mail stops; Windows builds are not affected at all. Per the authoritative assessment the vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), i.e. unauthenticated with no user interaction, but impact is bounded to availability only; no public exploit identified at time of analysis, and the fix ships in release 6.3.6.
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to brute-force the server administrator's password through the administrator's own browser when the optional REST API listener is enabled, ultimately gaining full administrative control of the mail server. Two flaws combine to enable this: the listener answers requests regardless of the Host header they carry, and failed administrator sign-ins originating from the loopback address are neither throttled nor auto-banned, so a rebound page can submit password attempts at full speed until one is accepted. Exploitation is conditional rather than casual - the REST API listener is off by default and loopback-bound when enabled, an administrator must open the attacker's page in a browser running on the server host itself, and the attacker must control DNS for a name they can rebind to 127.0.0.1; no public exploit has been identified at time of analysis.
Denial of service in wolfSSL 5.9.1 and 5.9.2 allows remote, unauthenticated attackers to cause wolfSSL-based TLS clients to incorrectly reject valid server certificates that lack a Subject Alternative Name (SAN) extension by supplying crafted Certificate Authority certificates during the handshake. The vulnerability resides in the ConfirmNameConstraints() function in wolfcrypt/src/asn.c and affects only client-side certificate validation; patched or other versions are not impacted. No public exploit code has been identified at time of analysis.
Security restriction bypass in IBM DataPower Gateway leaves the appliance's authorization logic exploitable by unauthenticated remote attackers, allowing them to reach functionality or data that should have required elevated privileges. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; the CVSS 3.1 vector (7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms the attack is network-reachable with no credentials and no user interaction, but the high attack-complexity component means some condition outside the attacker's control - such as a particular request sequence, timing, or policy/configuration state - must be satisfied first, and the gateway service must be network-reachable at all. IBM's own PSIRT reported the issue and no public exploit code or confirmed active exploitation has been identified at time of analysis; impact is scored high for confidentiality and integrity with no availability impact, so the practical risk is unauthorized read/modification of gateway-mediated data or configuration rather than denial of service.
OS command injection in Brocade Fabric OS configuration management can allow arbitrary command execution on a switch when an administrator initiates a configuration download using a malicious or compromised configuration file. Affected versions are Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation requires high administrative privileges to start the download and a crafted config containing shell metacharacters in parameters, relay host strings, or filenames. No public exploit identified at time of analysis; the input assigns CVSS 4.0 base 7.3, but the assessed CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:R, reflecting a malicious-insider or config supply-chain scenario rather than opportunistic remote scanning.
Signature-verification bypass in NearForm fast-jwt 6.2.4 lets a remote, unauthenticated attacker forge HS256-signed JWTs with arbitrary claims when the application supplies a raw serialized public JWK or JWKS JSON string as the verifier key and HS256 (or another HS* algorithm) is allowed or auto-inferred. Because JWK public material is public by design, those exact JSON bytes become the HMAC secret, so the attacker can mint tokens that createVerifier accepts - the affected configuration is narrow but the impact is a full authentication/authorization bypass. Exploitation requires the attacker to reproduce the victim's exact serialized bytes (property ordering and whitespace must match), and publicly available exploit code exists; CISA KEV does not list this CVE and EPSS data was not provided. Version 6.3.0 fixes the flaw. CWE-347 (Improper Verification of Cryptographic Signature).
TLS certificate verification bypass in @fastify/reply-from versions prior to 12.7.0 allows an on-path attacker to impersonate the configured HTTPS upstream, intercept forwarded credentials and request bodies, and return forged responses. The plugin's built-in HTTPS transports override the secure default by setting rejectUnauthorized to false, so even in the default configuration with an https:// upstream, the proxy fails to validate the upstream's certificate. No public exploit identified at time of analysis. Upgrade to 12.7.0 or apply documented workarounds.
SQL injection in the MariaDB Connector/Node.js driver (CWE-89) allows unauthenticated remote attackers to break out of string literals and execute arbitrary SQL with the application's database privileges when the session runs with NO_BACKSLASH_ESCAPES enabled. The flaw affects all releases prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4: the connector's text-protocol escaper, including Connection.escape(), always prefixes quotes with a backslash and ignores the session's NO_BACKSLASH_ESCAPES mode, in which the backslash is an ordinary character and cannot escape the quote. Exploitation is conditional rather than drive-by: it requires NO_BACKSLASH_ESCAPES to be active (server-wide, set through connector initialization options, or via an application-issued SET sql_mode - not the default MariaDB/MySQL behavior), requires attacker-controlled values to reach query() or Connection.escape() text protocol handling, and does not apply to execute() or batch(), which use binary protocols. Vendor-released patch: 3.2.5, 3.3.4, 3.4.7, 3.5.4; no public exploit identified at time of analysis (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N), though a HackerOne report and public commits document the defect.
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation cannot be completed, letting an attacker who is on-path for both DNS and SMTP silently downgrade or redirect mail addressed to DNSSEC-signed recipients. When a TLSA or MX lookup returns no answer, SERVFAIL, a malformed reply, an answer lacking NSEC/NSEC3 proof of absence, or records without an applicable RRSIG, the server treats the domain as unsigned and proceeds - and from 6.2.19 it will also deliver to mail exchangers drawn from an unvalidated MX lookup that the DNSSEC-validated MX set did not name. The result is delivery in cleartext or to an attacker-chosen host with an arbitrary certificate, where messages can be read and modified; CVSS is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) because exploitation requires an active on-path position against both the resolver path and the mail path, and no public exploit identified at time of analysis. The vendor addressed this in release 6.3.6.
Outbound SMTP deliveries from hMailServer 6.0.0 through 6.3.5 can be transmitted in cleartext when the recipient mail exchanger publishes DNSSEC-validated TLSA records that contain only DANE-TA (usage 2) records or otherwise unusable records and no DANE-EE (usage 3) record, because the server incorrectly treats such a validated record set as if no DANE data existed and reverts to opportunistic TLS. An attacker holding an active on-path (MITM) position between the server and that MX can suppress or break STARTTLS and read and modify messages in transit, yielding high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4). No public exploit code was identified at time of analysis; exploitation is conditional on a non-default recipient TLSA layout plus a real-time network-path position, making this a targeted rather than broadly exploitable issue, and no user interaction or authentication is required per the assessed vector.
Banks, a Python library for generating LLM prompts from a simple template language, ships a DirectoryPromptRegistry that prior to version 2.5.1 fails to reject symbolic links for its index.json file and for discovered or existing .jinja prompt files. An attacker who can influence the contents of the registry directory - for example by planting a symlink or by controlling files extracted from an untrusted archive into that directory - can cause _scan() and get() to follow a link outside the registry root and disclose arbitrary files, while set(), _save() and _load() can read or overwrite an external link target, giving high confidentiality and integrity impact with limited availability impact. Exploitation requires local placement influence over the prompt directory and applies only to deployments that use DirectoryPromptRegistry and expose that directory to untrusted input, which is why the vendor CVSS 4.0 base score is 7.3 (AV:L/AC:L/AT:P/PR:L/UI:N) and the assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. The issue is fixed in version 2.5.1.
Privilege escalation in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated CLI user or local process to bypass Role-Based Access Control (RBAC) validation by manipulating the process execution environment, resulting in root privileges. The flaw requires local access (AV:L), a low-privilege authenticated foothold (PR:L), and high attack complexity (AC:H) to control environment variables or settings, sharply narrowing exposure. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated file upload in Eimzamip v1.6.4 and v1.6.5 (every release before v1.6.6) allows a low-privilege user to store files of dangerous type because the application fails to validate or restrict uploaded content (CWE-434). Per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N (score 7.3), remote exploitation requires a valid authenticated session on the product's upload functionality plus a user-interaction step - typically a victim or operator opening or processing the planted file - after which confidentiality and integrity impact is high, while scope remains unchanged. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a moderate-priority issue rather than a top-tier emergency.
Cross-project resource manipulation in OpenStack Mistral through 23.0.0 allows an authenticated project member to rewrite and un-publish another project's public action definitions and environments via the v2 API, while a project administrator can relocate another project's resource by creating a workbook with a colliding embedded action or workflow name. This incorrect authorization vulnerability (CWE-863) has a CVSS 4.0 base score of 7.2 (High) and requires a valid account on a multi-tenant cloud that exposes the Mistral v2 API; no public exploit code was identified at time of analysis, and the impact is primarily integrity (VI:H) with limited confidentiality and availability effects. Deployments without the Mistral API exposed are not affected.
Privilege escalation and command injection in the inter-switch remote execution service of Brocade Fabric OS let an attacker who already holds high privileges on one fabric-joined switch bypass authentication checks on the receiving switch and execute arbitrary root commands, either locally or on other managed fabric members where remote command execution is enabled. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; switches running 9.2.2d or later are not affected. Exploitation is access-gated rather than mass-exploitable: it requires an existing high-privilege foothold on a switch already joined to the target fabric and the inter-switch remote execution feature to be enabled on the receiving members, and no public exploit has been identified at time of analysis (no CISA KEV listing).
Arbitrary code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions) when an attacker who already holds administrative privileges on the appliance and can reach the local management interface supplies input that overflows a fixed-size stack buffer. The assessed CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with CWE-787 as the root cause, so the flaw is high-severity on impact but gated by a strong prerequisite: administrative control of the management plane rather than unauthenticated reach. Patch available per vendor advisory (IBM support page node/7291628); there is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC decision points record Exploitation: none, Automatable: no, Technical Impact: partial.
Authenticated Kerberos clients can cause a NULL pointer dereference in MIT Kerberos 5 through 1.22.2 by sending a forwarded KRB-CRED message with more tickets than ticket_info entries to a GSS-API acceptor service, resulting in a service crash (denial of service). The vulnerability requires the attacker to hold a valid Kerberos principal and the target to process forwarded credentials via gss_accept_sec_context(); impact is limited to availability with no confidentiality or integrity effect. No public exploit code identified at time of analysis, and a patch is available via upstream commits.
OS command injection in the maintenance command-line diagnostic utilities of Brocade Fabric OS allows an attacker who already holds maintenance-level credentials to run arbitrary operating-system commands with root privileges on the switch. Only Fabric OS versions before 9.2.2d and the 10.0.0 through 10.0.0a1 range are affected; the vulnerable binaries pass user-supplied option parameters unsanitized into a shell interpreter, so crafted metacharacters escape the diagnostic tool's intended behavior. This is a constrained privilege-escalation issue (CVSS 4.0 7.0 / 3.1 AV:L/AC:L/PR:H/UI:R, CWE-78) rather than a mass-exploitation threat - it requires an existing privileged maintenance-account session with local or console/session access, and there is no remote unauthenticated path. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV).
Unauthenticated attackers with access to an adjacent network segment can crash the web management daemon on Brocade Fabric OS versions before 10.0.1 by sending a single HTTP request containing extreme numerical values in a specific URL query parameter. The flaw is an out-of-bounds memory read that triggers an invalid memory dereference, resulting in a denial of service that temporarily disrupts the management plane but does not affect Fibre Channel data-plane traffic. No public exploit code has been identified at the time of analysis, and the primary limiting factor is that the attacker must be on the management LAN rather than the open internet.
Unauthenticated denial of service in the TP-Link Tapo C325WB v2 camera allows a crafted pair of RTSP-over-HTTP tunneling requests sent to the streaming service on TCP port 554 to corrupt memory (stack-based buffer overflow, CWE-121) and crash the streaming daemon, disrupting live video and related streaming functions until the daemon recovers or restarts. Only cameras with the optional Camera Account feature enabled are exposed, and the attacker must be positioned on the same adjacent network segment (Wi-Fi or LAN) as the camera, since the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no authentication or user interaction is required. Impact is availability-only and temporary, no public exploit identified at time of analysis, and a vendor patch is available per the TP-Link firmware release notes and advisory FAQ 5333.
Account takeover of Eclipse Ditto Explorer users is possible via a crafted link that injects an attacker-controlled OIDC authority or API URI when the autoSso feature is enabled (versions 3.6.0 through 3.9.7). The victim's OAuth authorization code and PKCE verifier are redirected to the attacker's token endpoint, enabling redemption for access and refresh tokens; alternatively, bearer tokens or Basic credentials are leaked to an attacker-controlled api_uri. Exploitation requires unauthenticated remote attackers to convince a victim to click the link and authenticate, but the configuration persists, causing repeated token theft on subsequent visits; no public exploit code has been identified at time of analysis, and the independent assessment deems this a credible but conditional account-takeover flaw rather than a mass-exploitation emergency.
Authenticated non-admin users of Apache DolphinScheduler 3.2.0 up to (but not including) 3.4.3 can retrieve the Kubernetes kubeconfig that administrators stored for cluster integration, because the API that serves that data performs no authorization check (CWE-862). With the disclosed kubeconfig an attacker can authenticate directly to the Kubernetes API from outside DolphinScheduler, and the real-world severity is bounded by whatever privileges the embedded service account holds - cluster-admin-grade credentials expose Kubernetes Secrets and allow pod creation and persistence, while narrowly scoped credentials sharply limit what is achievable. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the issue is unreachable on deployments that never configured Kubernetes cluster integration or where the requester cannot obtain even a low-privileged account.
Read-only management accounts on Brocade Fabric OS switches can escalate to restricted administrative operations by submitting management-protocol requests whose non-standard action opcodes the RBAC validation engine mis-categorizes during its permission check; the flaw affects Fabric OS releases before 10.0.1 and is scored CVSS 4.0 base 7.1 (CWE-269, improved privilege management failure). Exploitation is gated: an attacker must already hold a valid authenticated read-only management account (PR:L) and be positioned on an adjacent/management network (AV:A) to reach the affected management plane, with no user interaction required (UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so practical risk is driven by the attacker's existing credentials and management-network access rather than by remote unauthenticated reachability.
Broken authorization in Apache DolphinScheduler before 3.4.3 allows any authenticated user to retrieve connection details - including stored data source passwords - for data sources they are not authorized to access via the /unauth-datasource and /authed-datasource endpoints. Exploitation is network-reachable (AV:N), low complexity (AC:L), requires no user interaction (UI:N) and only a valid low-privileged account (PR:L), yielding high confidentiality impact (C:H) with no integrity or availability impact per our assessment; NVD/vendor scoring differs slightly by also crediting low integrity impact (I:L). Because the leaked credentials can be reused against the underlying databases, the practical consequence extends beyond information disclosure to potential downstream database compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is version 3.4.3.
Brocade Fabric OS Management Server before version 10.0.1 can be manipulated by a compromised or rogue Fibre Channel switch that is already trusted within the fabric, which uses crafted inband vendor-unique Common Transport (CT) management requests to bypass administrative authentication. This lets the unauthorized peer perform sensitive administrative actions on the target device, including resetting administrative passwords, rebooting the system, and initiating firmware downloads. The attack is confined to the Fibre Channel fabric and cannot be launched from the management IP network or the internet; it requires a pre-compromised fabric peer (assessed AV:A/AC:H with an AT:P precondition in the vendor vector), and no public exploit code has been identified at time of analysis.
Command-line argument injection in SumatraPDF 3.5.2 and earlier lets an attacker-controlled SyncTeX source filename escape the quoting of an external editor's command template and inject arbitrary flags when a victim triggers inverse search. The attack is strictly conditional: it requires a PDF paired with a crafted sibling .synctex.gz file, a configured or auto-detected inverse-search editor, and a deliberate user action (double-clicking to jump to source) at a coordinate that maps to the malicious node. Per the advisory-supported conditions, code execution is not guaranteed by SumatraPDF itself and depends on the target editor honoring the injected flags (for example, installing a malicious extension), so this is a moderate, conditional risk rather than a drop-everything priority; no public exploit has been identified at time of analysis, and no fixed release is available as of this review, though an upstream fix commit exists.
Argument injection in the AI translation feature of SumatraPDF 3.6.1 and earlier allows text placed in a document selection or clipboard to be interpreted as command-line flags when an agentic CLI backend (Grok, Claude Code, or Codex) is configured as the translation provider. Because the vulnerable code builds the child process command line with quote-only escaping, attacker-controlled text can smuggle in flags that alter the model, working directory, approval mode, or sandbox settings used by the launched CLI. Exploitation is local and requires the user to actively invoke the translate/AI-chat action on the crafted text, and only affects installations where one of those agentic CLI backends is installed and selected; no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.
Denial of service in MongoDB libmongocrypt occurs when KMS endpoint parsing triggers an integer underflow, causing an allocation failure that terminates the application process. This can be triggered by an authenticated user with write access to the key vault collection modifying a key document, or when an application passes a KMS endpoint containing a colon after its path or query during key creation. No public exploit code has been identified at time of analysis, and the vulnerability does not allow code execution, data disclosure, or data tampering-only a crash.
Reflected cross-site scripting in the aBlocks plugin for WordPress (versions through 2.16.0) lets an unauthenticated remote attacker run arbitrary script in a victim's browser by enticing them to open a crafted link, as the malicious input is echoed back in the generated page rather than stored (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation hinges on victim interaction, and the highest-impact scenario is luring a logged-in administrator, whose hijacked browser session can be used to perform privileged actions against the site. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score or known exploitation activity was supplied in the available intelligence.
Cluster-wide denial of service in OpenStack Mistral (all versions through 23.0.0) lets any authenticated holder of a valid Mistral token - regardless of role or tenant - read and alter the service's global maintenance state through the /v2/maintenance API, because the controller clears the request context and calls the maintenance service without any policy enforcement. Setting the state to PAUSED halts processing of new workflow and execution objects for every tenant project until an operator intervenes, giving a lowest-privileged tenant member a persistent, cross-tenant availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 7.1 High; NVD's CVSS 4.0 vector scores identically at 7.1 High). Exploit path is reachable against default configurations with no feature flag or non-default setting required, but it is not anonymously exploitable - a valid Mistral API token is the single prerequisite. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; patch availability is not confirmed in the provided data.
Cross-site request forgery in the CISA Malcolm network traffic analysis platform lets a remote attacker who lures the operator into loading attacker-controlled web content force that operator's browser to fire unauthenticated management commands at the kiosk's POST /script_call/<script> endpoint. Successful abuse yields high integrity and availability impact (I:H/A:H) with no confidentiality impact (C:N), because the reachable commands are destructive rather than data-stealing - most notably control.py --wipe, which permanently deletes all captured network traffic and forensic logs, and control.py --stop, which blinds security monitoring. The endpoint ships with zero authentication and wildcard CORS (CORS(app)) in its default state, so no server-side misconfiguration is required; the only real barrier is inducing the specific operator to render a malicious page (UI:R). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Server-side request forgery (SSRF) in the Malcolm file-upload component allows authenticated low-privilege attackers to force the server to download arbitrary URLs via the unmodified upstream FilePond PHP fetch API route, then read back the fetched content through the transfer directory. The flaw, identified as CWE-918, affects Malcolm deployments using the file-upload feature and can expose internal network services or cloud metadata due to curl's FOLLOWLOCATION behavior. No public exploit identified at time of analysis; exploitation requires access to the upload endpoint (PR:L), and impact is limited to confidentiality readback plus minor availability (storage consumption).
Authenticated attackers with a Zimbra Collaboration Suite account can exploit an authorization flaw in the GrantRightsRequest SOAP operation to grant the loginAs right to another local account, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry. The vulnerability requires only low privileges (PR:L) and no user interaction, affecting all versions of Zimbra Collaboration Suite per the CPE. No public exploit or active exploitation has been identified at time of analysis, but the moderate CVSS score of 7.1 reflects the high confidentiality impact and the stealthy, persistent nature of the granted access.
An authenticated low-privileged member of a pH7Builder (pH7 Social Dating CMS) site running a version before 18.5.1 can upgrade themselves to the most expensive paid membership tier without paying the corresponding price. The payment controller trusts client-supplied plan and amount parameters - specifically item_number, cart_order_id, and the PayPal 'custom' field - so an attacker can pay a token amount (or submit an uncompleted PayPal IPN notification) and still be granted the highest tier and all of its paid features. The flaw requires a valid member account (CVSS 4.0 PR:L) and an instance that actually sells paid tiers through an enabled gateway, notably PayPal; no public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 18.5.1.
Out-of-bounds heap reads in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows (versions before 2.8.88) let a malicious or compromised VNC server crash the viewer and leak small amounts of adjacent heap memory into the rendered framebuffer. The victim must initiate the VNC session to the attacker-controlled or man-in-the-middle'd server and the connection must negotiate ZRLE encoding; the server then sends palette-based tiles whose colour indices exceed the declared palette size, causing readPaletteRleTile() and readPackedPaletteTile() to index past the end of the palette allocation. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H (7.1), a medium-to-high client-side flaw whose score is driven almost entirely by availability impact (viewer termination) plus a limited confidentiality leak (heap bytes rendered as garbled colours), with no code execution achieved; no public exploit code has been identified at time of analysis, and vendor patches are available in 2.8.88.
Cross-site request forgery in the WPMU DEV Forminator WordPress plugin, affecting all versions through 1.57.3, lets an unauthenticated attacker craft a malicious page that, when visited by a logged-in site administrator, silently submits state-changing requests to the vulnerable site on that administrator's behalf. The CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N), reflecting high integrity impact offset by the required victim interaction and no availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied. Risk is bounded by the interaction requirement: the attack fails if the targeted privileged user is not currently authenticated in a browser session while visiting the attacker-controlled page.
Stored cross-site scripting can be planted on WordPress sites running the WPComplete plugin through version 2.9.5.6, because a WPComplete write action is performed without adequate CSRF nonce validation (CWE-352) and the stored value is later rendered without sufficient output encoding. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) the attacker needs no credentials of their own, but exploitation requires tricking a logged-in, privileged WordPress user into visiting an attacker-controlled page or link while their session is active, which is the primary limiting factor. No public exploit code or confirmed active exploitation was identified at time of analysis, and the net effect is a moderate-priority risk: injected script executes in the site context (scope changed) and can affect other users, but impact to confidentiality, integrity, and availability is each rated Low.
Command injection in the Brocade Fabric OS firmware management daemon lets a management user with high privileges execute arbitrary shell commands with the daemon's elevated privileges on switches running Fabric OS before 9.2.2d or 10.0.0 through 10.0.0a1. Because the CVSS vector is local (AV:L), requires high privileges (PR:H) and an operator-driven upgrade workflow (UI:P/UI:R), this is a privilege-boundary flaw for an already-authorized administrator rather than unauthenticated remote takeover, though successful exploitation yields full confidentiality, integrity and availability impact confined to the affected Fabric OS instance. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Authenticated low-privilege local users on Brocade Fabric OS switches can abuse the diagnostic kernel module subsystem to invoke privileged hardware tests, force system error conditions, perform hardware blade resets, and disrupt storage fabric operations, because those interfaces ship with improper file permissions and lack authorization checks (CWE-732). Only devices running FOS builds before 9.2.2d, or in the 10.0.0 through 10.0.0a1 range, are affected, and exploitation requires an existing account with shell/CLI access on the switch rather than unauthenticated network reachability. No public exploit code or confirmed active exploitation has been identified at time of analysis (no CISA KEV entry), and the CVSS:3.1 assessment (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) places this at moderate risk: the impact is confined to integrity and availability, with no confidentiality or data-disclosure component.
Local privilege escalation in Brocade Active Support Connectivity Gateway (ASCG) before 3.5.0 stems from a well-known Brocade default password embedded in a script that is distributed to every customer, allowing any local authenticated user with read access to the installation path to recover the credential and elevate privileges on Open Virtual Appliance (OVA) deployments where default configuration settings remain in place. The flaw is rated 7.0 (High) under CVSS 4.0 with a local vector (AV:L, PR:L, UI:P), meaning an attacker must already hold a low-privilege local account and passive user interaction is required, so it is not remotely reachable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic risk is concentrated on OVA deployments that have not rotated the default credential.