Unauthenticated remote attackers can drive IBM DataPower Gateway into resource exhaustion and denial of service by sending crafted GraphQL queries that abuse improper memoization of fragment spreads. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, and per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector no authentication or user interaction is required once a reachable GraphQL-processing endpoint exists. Impact is confined to availability (no confidentiality or integrity loss), and there is no public exploit identified at time of analysis; exposure depends entirely on whether the gateway has been configured to accept and process GraphQL requests.
Denial of service in IBM DataPower Gateway lets unauthenticated remote attackers send crafted network traffic that triggers an out-of-bounds write (CWE-787), degrading or halting the gateway's availability. The flaw affects version lines 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, scoring CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with availability-only impact. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but IBM has published a vendor fix, so internet-facing gateways should be treated as the highest-priority upgrade target.
A heap buffer underwrite in IBM DataPower Gateway allows unauthenticated remote attackers to crash the gateway service, producing a denial-of-service condition on affected appliances. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), the flaw is reachable over the network with no privileges or user interaction required, and impact is confined to availability (C:N/I:N/A:H). Affected firmware spans 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
IBM DataPower Gateway is vulnerable to a remote, unauthenticated denial of service (CVSS 3.1 base 7.5) in which a crafted request triggers an out-of-bounds read, degrading or crashing the affected gateway service. All supported firmware streams in the affected ranges are exposed: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6 (the 10.6 CD stream), and 11.0.0.0 through 11.0.0.2. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms exploitable over the network with no authentication, privileges, or user interaction, but restricts impact to availability - no confidentiality or integrity loss is assessed - so exploitation results in service disruption rather than compromise; there is no public exploit identified at time of analysis, and a vendor patch is available.
Unauthenticated remote attackers can crash IBM DataPower Gateway by sending a crafted request that triggers a null pointer dereference, resulting in a denial of service that takes the affected service interface offline. All four maintained release trains are affected: 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or privileged position is needed - only network reachability to a vulnerable, unpatched gateway - and the sole impact is availability (C:N/I:N/A:H), with no data exposure or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible but bounded availability risk that is governed primarily by how exposed the gateway's service interfaces are to untrusted networks.
IBM Guardium Data Protection 12.0, 12.1, and 12.2 ship with hard-coded credentials that a remote, unauthenticated attacker (CVSS PR:N/UI:N) can abuse to read sensitive information from the affected appliance service, yielding a high confidentiality impact with no integrity or availability loss (C:H/I:N/A:N, base 7.5). Exploitation is not trivial in practice: the attacker must first know or recover the static credential value and must be able to reach the Guardium management or data service over the network, which is typically an internal, segmented appliance rather than an internet-facing endpoint. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.30% (21st percentile), so this rates as a genuine but moderate-priority exposure that should be scheduled rather than emergency-patched.
A type confusion flaw (CWE-843) in IBM DataPower Gateway lets a remote, unauthenticated attacker crash a reachable gateway service, producing a denial-of-service condition. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a network-reachable, low-complexity, unauthenticated trigger with availability-only impact. IBM has published a vendor fix via its support advisory, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
PHP object injection in the WordPress plugin Uncanny Automator - AI + Automation for WordPress (all versions up to and including 7.6.1.1) lets an authenticated attacker with Subscriber-level access or above pass attacker-controlled data into an unserialize() sink via recipe trigger meta, and a POP chain present in Uncanny Automator itself escalates that into deletion of arbitrary files on the server. Exploitation is conditional rather than trivial: it additionally requires at least one supported third-party integration plugin (PeepSo, MailPoet, WPForms, and similar) to be co-installed and a recipe to be configured so that attacker-supplied input is stored as trigger meta - a combination of prerequisites that is why the assessed vector is AC:H and the plugin's real-world exposure is best characterized as a genuine but conditional risk rather than a mass-exploitation emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Privilege escalation in Brocade Fabric OS (versions before 10.0.1) allows a low-privilege authenticated account to obtain root-equivalent chassis administrative access when the switch is configured to use an external AAA identity source. The switch fails to constrain crafted Vendor-Specific Attributes or directory claims returned by RADIUS, LDAP, TACACS+, or a Federated IdP against its administrative role restrictions during session establishment, so an attacker who can influence those returned attributes is granted full control. Exploitation is conditional rather than mass-scale: it requires external AAA integration to be configured (deployments using only local authentication are unaffected), a valid low-privilege account (CVSS PR:L), management-network adjacency (AV:A), and attacker influence over IdP-returned attributes (AT:P); no public exploit code was identified at time of analysis, and vendor-released patch version 10.0.1 is available.
Denial of service in the npm package music-metadata before 11.15.0: parsing a crafted .dsf (DSF) file causes an unhandled promise rejection that terminates the Node.js process, and because the rejection is detached from the parse promise the crash occurs after parseBuffer() has already resolved, so a caller's per-file try/catch catches nothing and the process still dies. Publicly available exploit code exists - a PoC targeting 11.14.0 ships in the advisory's repro/ directory and confirms the crash on Node's default unhandled-rejection behavior - but there is no evidence of active exploitation and the CVE is not in CISA KEV. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, availability-only), EPSS is low at 0.20% (9th percentile), and CISA SSVC records Exploitation: poc with Technical Impact: partial.
Authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers forge JSON Web Signatures and present themselves as a trusted, already-verified identity on gateways that use JWS/JWT signature verification for access control. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) exploitation requires no credentials or user interaction and the impact is integrity-only, meaning the payoff is forged trust and unauthorized access rather than direct data disclosure. No public exploit identified at time of analysis, EPSS is low at 0.20% (9th percentile), and the CISA SSVC assessment records exploitation as none with automation not feasible, so this is a genuine but moderate-priority issue rather than a top-tier emergency; vendor patches are nonetheless available.
Improper authorization enforcement in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 can allow unauthenticated remote attackers (PR:N, UI:N) to bypass access controls and alter protected content or state (I:H, C:N, A:N) when the product is deployed in front of certain web servers. The flaw, however, is configuration-dependent: as reflected by the AV:N/AC:H vector and IBM's scoping to 'some' web servers, only specific protected web-server integrations are exposed, and default or unaffected setups are not exploitable. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM rates the issue 5.9 (moderate); the affected deployments also include the containerized editions of both products.
Response smuggling is possible in Go's HTTP/2 implementation (net/http and golang.org/x/net/http2) when a program acts as a reverse proxy that receives an HTTP/2 upstream response and forwards it to a downstream HTTP/1 client. Because Go has historically not rejected malformed framing-related headers such as connection-specific or length-related headers that RFC 7540 requires to be treated as malformed, those headers can be relayed verbatim; if the downstream HTTP/1 client is also lenient in parsing, the attacker can desynchronize the response stream and smuggle content. The issue is unauthenticated from the network perspective (CVSS PR:N) but exploitation is constrained to that specific proxy topology and requires attacker influence over the upstream response plus a non-strict HTTP/1 client; there is no public exploit identified at time of analysis, EPSS is low at 0.19% (8th percentile), and CISA SSVC records no exploitation with partial technical impact.
Stored cross-site scripting in the GPTranslate WordPress plugin (versions below 2.34.14) lets unauthenticated attackers submit translation strings that the plugin stores without proper authorization checks and later renders without output escaping, so malicious JavaScript executes in the browser of any user who views a poisoned translated page. The flaw is only reachable when the plugin's server-side translations feature is enabled, meaning sites relying on client-side translation are not exposed, and successful abuse still depends on a victim subsequently loading the affected page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; a vendor patch is available in version 2.34.14.
Request smuggling in the Go net/http standard library occurs when an application handler answers an HTTP/1 CONNECT request with a 2xx status and then returns without hijacking the connection, causing the server to keep parsing HTTP requests on a connection that an intermediate proxy now treats as an opaque tunnel. Affected builds are net/http before 1.26.9 and the 1.27.x line before 1.27.2 (CWE-444, parser disagreement between proxy and origin server). Exploitation requires a non-default handler pattern plus a fronting proxy, so despite the published CVSS base of 7.5 the assessed real-world priority is moderate-to-low; no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none with Technical Impact: partial.
Unauthenticated remote attackers can exhaust server memory in applications built on the Go standard library by submitting crafted multipart/form-data requests, because the mime/multipart parser reads an arbitrarily long line into memory whenever the remaining memory limit at the start of a part drops below 400 bytes. Affected runtimes are Go releases prior to 1.27.2 and prior to 1.26.9, including the mime/multipart and net/textproto packages; any service that parses attacker-supplied multipart forms - for example via net/http Request.ParseMultipartForm or Request.FormFile - is reachable, while internal or non-multipart endpoints are not. This is a denial-of-service (CWE-770) issue with no confirmed active exploitation and no public exploit code identified at time of analysis; EPSS is 0.18% (7th percentile), CISA SSVC rates exploitation as none with partial technical impact, and the vendor has shipped patched releases.
Denial of service in libming through 0.4.8 occurs when a libming-based tool parses an attacker-supplied malformed SWF file through the readtag_file() code path in src/blocks/fromswf.c, causing the parsing process to crash or exhaust resources. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) shows this requires user interaction and carries only availability impact, so remote exploitation applies only where a network service actually feeds untrusted SWF input into libming, while a standalone CLI run needs a user or process to open the crafted file. No public exploit code was identified at time of analysis and EPSS is 0.18% (7th percentile), so despite NVD's 7.5 base score the real-world priority is low.
Remote memory exhaustion in the Go standard library's crypto/tls package lets a client that sends a crafted ClientHello containing multiple ECH outer extension references - a construction prohibited by RFC 9849 - force disproportionate memory allocation in TLS servers with Encrypted Client Hello enabled. Only Go releases before 1.27.2 and before 1.26.9 are affected, and the flaw is fixed in those two releases; no public exploit code exists and there is no CISA KEV listing at time of analysis. The practical attack surface is narrow because ECH is opt-in and not active in a default Go TLS server configuration, but where enabled the attacker needs no authentication or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5).
CPU exhaustion in the Go standard library's net/http file-serving handlers (FileServer, ServeContent, and ServeFile(FS)) lets remote unauthenticated attackers degrade or deny service by sending a single HTTP request whose Range header enumerates a large number of small ranges. The flaw affects net/http in Go releases before 1.26.9 and 1.27.0-0 before 1.27.2, but only on servers that actually expose those file-serving handlers; default configurations that use them are affected with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is availability-only, exploitation is not confirmed and no public exploit has been identified at time of analysis, EPSS is low at 0.17% (6th percentile), and patched releases are available from the vendor.
HTTP/1 connection desynchronization in Go's net/http Transport allows response poisoning for other users of a shared, pooled connection pool. When an outbound HTTP/1 CONNECT request carries a non-empty Request.Body, Transport writes those bytes to the wire unframed after the request headers; if the upstream server rejects the CONNECT with a non-2xx but connection-reusing (keep-alive) response, Transport returns the still-contaminated socket to the idle pool, and the backend may parse the trailing bytes as a pipelined follow-up request. The primary exposure is reverse proxies (including httputil.ReverseProxy) that forward CONNECT through a shared Transport, where the next caller to reuse the desynchronized connection reads the response to the injected request - an unauthenticated remote scenario per the CVSS vector (PR:N), though exploitation requires a specific chain rather than a default single request. No public exploit identified at time of analysis; EPSS is low at 0.17% (5th percentile).
Information disclosure in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the Security Verify Access Container and Verify Identity Access Container editions) allows unauthenticated remote attackers to read sensitive data from a network-reachable instance, per the CVSS vector AV:N/AC:L/PR:N/UI:N with confidentiality impact rated High and no integrity or availability effect. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, with the attack classified as not automatable and only partial technical impact, indicating targeted rather than mass-scannable abuse. Vendor-released fixes are available from IBM, so exposure is primarily a function of how reachable the identity appliance or container endpoints are from untrusted networks.
Denial of service in music-metadata versions prior to 11.16.0 lets remote attackers crash or exhaust memory in any application that parses an attacker-supplied MP4-family file. The MP4 atom parser trusts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and passes the oversized length into atom-specific readToken payload parsing (mvhd, stsd, stsz, or date) before confirming the atom fits within its parent or the remaining input, so a tiny crafted file can force a large allocation attempt or process failure. The flaw is remotely triggerable without authentication and without user interaction beyond the file being processed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5); publicly available exploit code exists, but there is no evidence of active exploitation, no KEV listing, and EPSS is low at 0.13% (2nd percentile), with impact confined to availability.
Unbounded synchronous looping in the unreleased music-metadata master-branch MP4 'stsd' sample-description parser lets a crafted 48-byte MP4-family file pin the Node.js event loop at ~100% CPU while an in-memory sample-description table grows until the process is killed externally or exhausts memory. The regression was introduced after 11.14.0 by commit d2a7d6f (PR #2693, which changed the cursor advance to 'off += size - 4' without guarding for small sizes) and exists only on the public master branch - no published npm release, including 11.14.0 and earlier, contains the vulnerable change, and 11.16.0 ships the fix. Exploitation requires an application that parses attacker-supplied MP4-family input through parseBuffer, parseFile, parseStream, parseBlob, or parseWebStream; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (no authentication, no user interaction, availability-only impact), no public exploit targeting released versions was identified at time of analysis, and the practical limiting factor for defenders is install method (git/master build versus npm release) rather than configuration.
Unauthenticated remote attackers can render IBM Security Verify Access (10.0 through 10.0.9.2) and IBM Verify Identity Access (11.0 through 11.0.3), including their container editions, unavailable by driving the software into uncontrolled recursion - a stack-exhausting condition with availability-only impact (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H). Because the vector specifies PR:N/UI:N, no credentials, user interaction, or special configuration are prerequisites, so any network-reachable, unpatched instance is a candidate and exposure management is the primary limiting factor; attacks against non-internet-facing deployments placed behind rate-limiting proxies are substantially harder to sustain. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records Exploitation: none and Automatable: no with partial technical impact, so this should be treated as a high-availability-risk but not currently exploited issue.
Authentication bypass in Jacamar CI before v0.30.0 allows authenticated CI users to generate arbitrary account names and impersonate other service accounts. The flaw (CWE-290) requires valid low-privilege CI credentials and a runner configured for service-account provisioning; no public exploit has been identified at time of analysis, and signals are mixed, pointing to a moderate rather than urgent priority. A vendor fix is available in v0.30.0.
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail delivery by sending messages crafted to look like RFC 3464 delivery status notifications or RFC 5965 abuse feedback reports whose returned-headers part begins with a very large number of blank lines. The DSN and ARF readers strip leading blank lines two bytes at a time, copying the remainder of the part on each iteration, so processing cost grows with the square of the blank-line count; a single report-shaped message within the reader's 2 MB limit can occupy a delivery thread for over a minute, and a few such messages per minute can saturate every delivery thread. Exploitation is conditional: the server must have bounce processing or complaint processing enabled, or must manage a mailing list, and the vendor states none of these is enabled by default, so a stock 6.3.4/6.3.5 installation is not exposed. There is no public exploit identified at time of analysis, no CISA KEV listing, and the impact is limited to availability of mail delivery (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no data exposure or code execution; the vendor-released fix is hMailServer 6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail delivery and SMTP service by sending a single crafted message. The root cause is inefficient algorithmic complexity (CWE-407) in inbound DKIM and ARC signature verification: assembling the canonical header and resolving the header names listed in a signature's h= tag grows quadratically with header size, so a message with very many header fields - or one field folded over very many continuation lines - holds a worker thread busy for tens of seconds per signature, and up to ten signatures are evaluated per message by both the DKIM and DMARC tests on the threads that serve delivery and SMTP. CVSS 3.1 rates this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity impact; no confirmed active exploitation (CISA KEV) or public exploit code was identified at time of analysis, and the vendor has published a fixed release, v6.3.6.
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make SMTP, IMAP, POP3, delivery, and REST API services unavailable by sending a crafted message. A non-terminating MIME header parsing loop pins a worker thread at full CPU until restart, but that path is only reached when the attachment blocker is configured to rename a blocked attachment or when a filename is set via the REST API; a broader quadratic-complexity path in RFC 2047/RFC 2231 header handling and repeated header deletion is reachable on default mail intake. No public exploit identified at time of analysis; vendor patch is version 6.3.6.
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first instance of each duplicated member name by rescanning the members already read, so an object with N distinct names costs O(N²) - roughly 8.9 seconds for a 1 MB payload and 300 seconds for 4 MB against the affected code. An unauthenticated remote attacker can reach this reader by mailing a crafted TLS-RPT report (compressed, expanding to as much as 16 MB after decompression) to a hosted domain's published report mailbox, where it is parsed on a delivery thread; with only ten delivery threads by default, a few such reports stall all mail delivery, both local and outbound, for over an hour per report. A signed-in webmail user can deliver the same 16 MB body through the webmail's own REST routes, holding the REST API worker threads instead. There is no confirmation of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; note that unauthenticated exploitation is confined to deployments that publish a TLS-RPT report mailbox, because where none is configured the unauthenticated REST sign-in routes that read JSON are capped at 64 KB and are not affected.
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 lets a remote peer stall outbound mail delivery by accepting a TCP/TLS connection and then sending nothing. Socket timeouts are applied in the form the Windows stack accepts but Linux refuses, and the server's HTTPS clients (MTA-STS, DANE TLSA, OAuth2, ACME) read without a deadline, so an attacker can pin worker threads indefinitely and stop delivery, ManageSieve, and metrics service for everyone else. The MTA-STS policy fetch is enabled by default and is performed during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound mail stops; Windows builds are not affected at all. Per the authoritative assessment the vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), i.e. unauthenticated with no user interaction, but impact is bounded to availability only; no public exploit identified at time of analysis, and the fix ships in release 6.3.6.
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to brute-force the server administrator's password through the administrator's own browser when the optional REST API listener is enabled, ultimately gaining full administrative control of the mail server. Two flaws combine to enable this: the listener answers requests regardless of the Host header they carry, and failed administrator sign-ins originating from the loopback address are neither throttled nor auto-banned, so a rebound page can submit password attempts at full speed until one is accepted. Exploitation is conditional rather than casual - the REST API listener is off by default and loopback-bound when enabled, an administrator must open the attacker's page in a browser running on the server host itself, and the attacker must control DNS for a name they can rebind to 127.0.0.1; no public exploit has been identified at time of analysis.
Denial of service in wolfSSL 5.9.1 and 5.9.2 allows remote, unauthenticated attackers to cause wolfSSL-based TLS clients to incorrectly reject valid server certificates that lack a Subject Alternative Name (SAN) extension by supplying crafted Certificate Authority certificates during the handshake. The vulnerability resides in the ConfirmNameConstraints() function in wolfcrypt/src/asn.c and affects only client-side certificate validation; patched or other versions are not impacted. No public exploit code has been identified at time of analysis.
Security restriction bypass in IBM DataPower Gateway leaves the appliance's authorization logic exploitable by unauthenticated remote attackers, allowing them to reach functionality or data that should have required elevated privileges. Affected builds are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; the CVSS 3.1 vector (7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms the attack is network-reachable with no credentials and no user interaction, but the high attack-complexity component means some condition outside the attacker's control - such as a particular request sequence, timing, or policy/configuration state - must be satisfied first, and the gateway service must be network-reachable at all. IBM's own PSIRT reported the issue and no public exploit code or confirmed active exploitation has been identified at time of analysis; impact is scored high for confidentiality and integrity with no availability impact, so the practical risk is unauthorized read/modification of gateway-mediated data or configuration rather than denial of service.
OS command injection in Brocade Fabric OS configuration management can allow arbitrary command execution on a switch when an administrator initiates a configuration download using a malicious or compromised configuration file. Affected versions are Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1; exploitation requires high administrative privileges to start the download and a crafted config containing shell metacharacters in parameters, relay host strings, or filenames. No public exploit identified at time of analysis; the input assigns CVSS 4.0 base 7.3, but the assessed CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:R, reflecting a malicious-insider or config supply-chain scenario rather than opportunistic remote scanning.
Signature-verification bypass in NearForm fast-jwt 6.2.4 lets a remote, unauthenticated attacker forge HS256-signed JWTs with arbitrary claims when the application supplies a raw serialized public JWK or JWKS JSON string as the verifier key and HS256 (or another HS* algorithm) is allowed or auto-inferred. Because JWK public material is public by design, those exact JSON bytes become the HMAC secret, so the attacker can mint tokens that createVerifier accepts - the affected configuration is narrow but the impact is a full authentication/authorization bypass. Exploitation requires the attacker to reproduce the victim's exact serialized bytes (property ordering and whitespace must match), and publicly available exploit code exists; CISA KEV does not list this CVE and EPSS data was not provided. Version 6.3.0 fixes the flaw. CWE-347 (Improper Verification of Cryptographic Signature).
Server-side request forgery in LinuxServer Heimdall through 2.8.3 lets an unauthenticated attacker coerce the server into issuing HTTP requests to arbitrary internal hosts and ports, including the cloud metadata address 169.254.169.254, by inducing a victim with network reachability to the instance to load attacker-controlled content that triggers the CSRF-reachable POST /test_config or GET /get_stats endpoints (CVSS 3.1 base score 3.4, vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Publicly available exploit code exists, but there is no indication of confirmed active exploitation, and the author scopes the CSRF exposure to only 'some realistic installations' where those endpoints are reachable. The realistic impact is a status/port oracle plus partial response data - not full response exfiltration - and the cloud-metadata path additionally requires Heimdall to run on an instance exposing an unauthenticated metadata service.
TLS certificate verification bypass in @fastify/reply-from versions prior to 12.7.0 allows an on-path attacker to impersonate the configured HTTPS upstream, intercept forwarded credentials and request bodies, and return forged responses. The plugin's built-in HTTPS transports override the secure default by setting rejectUnauthorized to false, so even in the default configuration with an https:// upstream, the proxy fails to validate the upstream's certificate. No public exploit identified at time of analysis. Upgrade to 12.7.0 or apply documented workarounds.
SQL injection in the MariaDB Connector/Node.js driver (CWE-89) allows unauthenticated remote attackers to break out of string literals and execute arbitrary SQL with the application's database privileges when the session runs with NO_BACKSLASH_ESCAPES enabled. The flaw affects all releases prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4: the connector's text-protocol escaper, including Connection.escape(), always prefixes quotes with a backslash and ignores the session's NO_BACKSLASH_ESCAPES mode, in which the backslash is an ordinary character and cannot escape the quote. Exploitation is conditional rather than drive-by: it requires NO_BACKSLASH_ESCAPES to be active (server-wide, set through connector initialization options, or via an application-issued SET sql_mode - not the default MariaDB/MySQL behavior), requires attacker-controlled values to reach query() or Connection.escape() text protocol handling, and does not apply to execute() or batch(), which use binary protocols. Vendor-released patch: 3.2.5, 3.3.4, 3.4.7, 3.5.4; no public exploit identified at time of analysis (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N), though a HackerOne report and public commits document the defect.
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation cannot be completed, letting an attacker who is on-path for both DNS and SMTP silently downgrade or redirect mail addressed to DNSSEC-signed recipients. When a TLSA or MX lookup returns no answer, SERVFAIL, a malformed reply, an answer lacking NSEC/NSEC3 proof of absence, or records without an applicable RRSIG, the server treats the domain as unsigned and proceeds - and from 6.2.19 it will also deliver to mail exchangers drawn from an unvalidated MX lookup that the DNSSEC-validated MX set did not name. The result is delivery in cleartext or to an attacker-chosen host with an arbitrary certificate, where messages can be read and modified; CVSS is 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) because exploitation requires an active on-path position against both the resolver path and the mail path, and no public exploit identified at time of analysis. The vendor addressed this in release 6.3.6.
Outbound SMTP deliveries from hMailServer 6.0.0 through 6.3.5 can be transmitted in cleartext when the recipient mail exchanger publishes DNSSEC-validated TLSA records that contain only DANE-TA (usage 2) records or otherwise unusable records and no DANE-EE (usage 3) record, because the server incorrectly treats such a validated record set as if no DANE data existed and reverts to opportunistic TLS. An attacker holding an active on-path (MITM) position between the server and that MX can suppress or break STARTTLS and read and modify messages in transit, yielding high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4). No public exploit code was identified at time of analysis; exploitation is conditional on a non-default recipient TLSA layout plus a real-time network-path position, making this a targeted rather than broadly exploitable issue, and no user interaction or authentication is required per the assessed vector.
An authenticated user with Viewer privileges can exploit a relative path traversal flaw in the data import functionality of Satel Netco Design versions prior to v2.1.7 to probe file paths outside the intended import directory and use application responses as an existence oracle for files on the host system. The vulnerability is network-reachable (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N) but requires valid low-privilege credentials, and its impact is confined to low confidentiality loss via file-existence inference; it does not disclose file contents, allow writes, or enable code execution. No public exploit identified at time of analysis.
Banks, a Python library for generating LLM prompts from a simple template language, ships a DirectoryPromptRegistry that prior to version 2.5.1 fails to reject symbolic links for its index.json file and for discovered or existing .jinja prompt files. An attacker who can influence the contents of the registry directory - for example by planting a symlink or by controlling files extracted from an untrusted archive into that directory - can cause _scan() and get() to follow a link outside the registry root and disclose arbitrary files, while set(), _save() and _load() can read or overwrite an external link target, giving high confidentiality and integrity impact with limited availability impact. Exploitation requires local placement influence over the prompt directory and applies only to deployments that use DirectoryPromptRegistry and expose that directory to untrusted input, which is why the vendor CVSS 4.0 base score is 7.3 (AV:L/AC:L/AT:P/PR:L/UI:N) and the assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. The issue is fixed in version 2.5.1.
Privilege escalation in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated CLI user or local process to bypass Role-Based Access Control (RBAC) validation by manipulating the process execution environment, resulting in root privileges. The flaw requires local access (AV:L), a low-privilege authenticated foothold (PR:L), and high attack complexity (AC:H) to control environment variables or settings, sharply narrowing exposure. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated file upload in Eimzamip v1.6.4 and v1.6.5 (every release before v1.6.6) allows a low-privilege user to store files of dangerous type because the application fails to validate or restrict uploaded content (CWE-434). Per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N (score 7.3), remote exploitation requires a valid authenticated session on the product's upload functionality plus a user-interaction step - typically a victim or operator opening or processing the planted file - after which confidentiality and integrity impact is high, while scope remains unchanged. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a moderate-priority issue rather than a top-tier emergency.
Cross-project resource manipulation in OpenStack Mistral through 23.0.0 allows an authenticated project member to rewrite and un-publish another project's public action definitions and environments via the v2 API, while a project administrator can relocate another project's resource by creating a workbook with a colliding embedded action or workflow name. This incorrect authorization vulnerability (CWE-863) has a CVSS 4.0 base score of 7.2 (High) and requires a valid account on a multi-tenant cloud that exposes the Mistral v2 API; no public exploit code was identified at time of analysis, and the impact is primarily integrity (VI:H) with limited confidentiality and availability effects. Deployments without the Mistral API exposed are not affected.
Privilege escalation and command injection in the inter-switch remote execution service of Brocade Fabric OS let an attacker who already holds high privileges on one fabric-joined switch bypass authentication checks on the receiving switch and execute arbitrary root commands, either locally or on other managed fabric members where remote command execution is enabled. Affected releases are Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1; switches running 9.2.2d or later are not affected. Exploitation is access-gated rather than mass-exploitable: it requires an existing high-privilege foothold on a switch already joined to the target fabric and the inter-switch remote execution feature to be enabled on the receiving members, and no public exploit has been identified at time of analysis (no CISA KEV listing).
Arbitrary code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including their container editions) when an attacker who already holds administrative privileges on the appliance and can reach the local management interface supplies input that overflows a fixed-size stack buffer. The assessed CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with CWE-787 as the root cause, so the flaw is high-severity on impact but gated by a strong prerequisite: administrative control of the management plane rather than unauthenticated reach. Patch available per vendor advisory (IBM support page node/7291628); there is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC decision points record Exploitation: none, Automatable: no, Technical Impact: partial.
Authenticated Kerberos clients can cause a NULL pointer dereference in MIT Kerberos 5 through 1.22.2 by sending a forwarded KRB-CRED message with more tickets than ticket_info entries to a GSS-API acceptor service, resulting in a service crash (denial of service). The vulnerability requires the attacker to hold a valid Kerberos principal and the target to process forwarded credentials via gss_accept_sec_context(); impact is limited to availability with no confidentiality or integrity effect. No public exploit code identified at time of analysis, and a patch is available via upstream commits.
OS command injection in the maintenance command-line diagnostic utilities of Brocade Fabric OS allows an attacker who already holds maintenance-level credentials to run arbitrary operating-system commands with root privileges on the switch. Only Fabric OS versions before 9.2.2d and the 10.0.0 through 10.0.0a1 range are affected; the vulnerable binaries pass user-supplied option parameters unsanitized into a shell interpreter, so crafted metacharacters escape the diagnostic tool's intended behavior. This is a constrained privilege-escalation issue (CVSS 4.0 7.0 / 3.1 AV:L/AC:L/PR:H/UI:R, CWE-78) rather than a mass-exploitation threat - it requires an existing privileged maintenance-account session with local or console/session access, and there is no remote unauthenticated path. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV).
Unauthenticated attackers with access to an adjacent network segment can crash the web management daemon on Brocade Fabric OS versions before 10.0.1 by sending a single HTTP request containing extreme numerical values in a specific URL query parameter. The flaw is an out-of-bounds memory read that triggers an invalid memory dereference, resulting in a denial of service that temporarily disrupts the management plane but does not affect Fibre Channel data-plane traffic. No public exploit code has been identified at the time of analysis, and the primary limiting factor is that the attacker must be on the management LAN rather than the open internet.