Authenticated OS command injection in the Linksys E1700 router's embedded web management interface (firmware 1.0.0.4.003) lets a remote attacker with low-privilege credentials execute arbitrary operating-system commands on the device by manipulating the _6rd_prefix and _6rd_prefix_len parameters handled by setLinksysIpv6 at /goform/setLinksysIpv6. The flaw scores 8.6 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N, E:P) and 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity and availability impact on the router. Publicly available exploit code exists - including a published proof-of-concept write-up referenced from the CVE record - but there is no confirmed actively exploited (CISA KEV) status, and no vendor patch has been released because Linksys did not respond to the disclosure; practical exploitation requires reachability of the HTTP management interface plus valid (or default/weak) credentials, which on default deployments is typically LAN-side.
OS command injection in the Linksys E1700 router running firmware 1.0.0.4.003 lets an attacker execute arbitrary shell commands on the device by sending a crafted request to the /goform/setDMZ endpoint with a manipulated MAC_addr parameter. Exploitation requires network reachability to the web management interface (LAN-side by default, or internet-facing if remote administration is enabled) plus at least low-privilege authenticated access, and needs no user interaction; the vendor did not respond to the disclosure, so no patch is available. Publicly available exploit code exists (a proof-of-concept is published on GitHub), which raises the likelihood of opportunistic attacks against exposed devices.
OS command injection in Linksys E1700 firmware 1.0.0.4.003 allows authenticated low-privilege attackers to execute arbitrary OS commands on the device via crafted input to the static route parameters in /goform/addStaticRoute. Publicly available exploit code exists, increasing the risk of exploitation; no vendor patch has been released as Linksys did not respond to the disclosure. The vulnerability requires network access to the management interface and valid credentials, but successful exploitation grants full control of the router.
Authenticated mass assignment in jshERP through 3.6 lets any user holding a valid low-privilege account overwrite protected fields on a user record - including tenant_id and password - by submitting a crafted PUT /user/update body, enabling silent cross-tenant identity switching on the next login or takeover of other accounts via password-hash overwrite. The vulnerable code path is the default UserController update handler and exploitation requires only an authenticated session (CVSS v3.1 base 8.7, PR:L, no user interaction or non-default configuration). Publicly available exploit code exists and no confirmed active exploitation (CISA KEV) has been reported at time of analysis.
Privilege escalation in jshERP through 3.6 allows any authenticated user, including one holding only minimal privileges, to assign themselves or any other user within the tenant the administrator role through the UserController updateUser (PUT user) handler, which performs no authorization check tying the role change to the caller's own privileges. An attacker sends their own user id together with a tenant administrator roleId (or rebinds another tenant user's role) and obtains full administrative control over business, financial, and user data managed by the platform. Publicly available exploit code exists as a Python proof-of-concept, and with a CVSS 4.0 base score of 8.7 (independently scored 8.7 under CVSS 3.1) the only meaningful precondition is possession of a valid low-privilege jshERP account; no user interaction or non-default configuration is required.
An authenticated remote stack-based buffer overflow in the Linksys E1700 router (firmware through 1.0.0.4.003) lets an attacker who can reach the device's HTTP management interface and hold a low-privilege session crash or potentially execute code on the device by sending an oversized vlan_set argument to the /goform/setVlan endpoint. Publicly available exploit code exists, including a GitHub proof-of-concept writeup, and the vendor was contacted early but did not respond, so no official fix is currently available. The vulnerability is rated CVSS 4.0 8.6 (independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires prior credentials or a hijacked authenticated session, and the management interface must be reachable from the attacker's position, giving this a targeted rather than mass-exploitation profile.
Stack-based buffer overflow in the Edimax BR-6208AC router running firmware 1.32 allows remote authenticated attackers to corrupt memory via the ateBW argument of the /goform/formWlanMP endpoint, potentially leading to code execution or denial of service. The product is end-of-life and the vendor did not respond, so no vendor patch exists; publicly available exploit code exists, but there is no evidence of confirmed widespread exploitation. Exploitation requires network access to the device's management interface and low-privilege authentication per the CVSS vector (PR:L), which limits anonymous internet-wide attacks; the realistic threat is highest where the admin interface is reachable by untrusted or semi-trusted users.
Permanent deletion of other users' survey submissions is possible in TDuck survey form through version 6.0 because the delete handler does not verify that the submission IDs in the request body belong to the caller. Authenticated users (CVSS vector PR:L) who can reach the POST user-form-data-delete endpoint can supply their own formKey in the path while iterating arbitrary, sequential submission IDs, allowing platform-wide erasure of form responses. Publicly available exploit code exists (a Python proof-of-concept is linked in the advisory), but there is no confirmed active exploitation (CISA KEV), so this is best treated as a bounded data-integrity and availability risk with an assessed CVSS of 7.1 (I:L/A:H, no confidentiality or code-execution impact). Instances exposed only to trusted internal users are substantially lower risk given the authentication prerequisite.
Authenticated information disclosure in jshERP through 3.6 exposes platform-wide configuration secrets, including SMTP authorization codes (email_auth_code) and activation codes (activation_code), to any logged-in user of any tenant at any privilege level via the getInfoByKey handler of PlatformConfigController. The endpoint applies a denylist that blocks only aliOss and weixin keys, so every other platformKey value is returned unredacted; no admin rights and no user interaction are required, though a valid low-privilege account is a prerequisite (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; NVD score 7.1). Publicly available exploit code exists - a proof-of-concept script that performs global configuration retrieval and enumeration is hosted on GitHub - but no CISA KEV entry confirms active exploitation, and impact is confined to confidentiality with no integrity or availability effect.
Authenticated users of dromara lamp-cloud through 5.10.1 can obtain storage access URLs for files owned by other users by sending arbitrary file ids to the findUrlById handler of FileAnyoneController, which performs no ownership check (CWE-639) and exposes uploaded attachments to unauthorized reading. Exploitation requires only a valid low-privilege account and knowledge or enumeration of victim file ids; publicly available exploit code exists, but the issue is not in CISA KEV and impact is confidentiality-only per the independent assessment (CVSS 4.0 base 7.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). This is a genuine but bounded access-control weakness rather than a top-tier emergency.
Information disclosure in MoguBlog through 6.2 lets any holder of an ordinary front-end reader session token retrieve unfiltered SystemConfig data - including Qiniu and MinIO secret keys and SMTP mailbox passwords - from the getSystemConfig endpoint over the network. The CVSS 4.0 base score is 7.1 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality impact and no integrity or availability impact), and the prerequisite is only a low-privileged authenticated reader account, which many public blogs allow users to self-register. Exploitation status: publicly available exploit code exists (a PoC script targeting the OAuth getSystemConfig path is published), but there is no confirmed active exploitation (no CISA KEV listing), and real-world impact is bounded by whether the deployment has actually configured Qiniu/MinIO storage or SMTP mail, since those are the credentials exposed.
Insecure direct object reference in lamp-cloud through 5.10.1 lets any authenticated user, regardless of privilege level, list and retrieve file attachments that belong to other business objects or tenants by supplying an arbitrary bizId to the listFileByBizId endpoint exposed by AppendixController. The response leaks file names, storage paths, MD5 hashes and stored URLs, and because the default LOCAL storage mode serves those attachments without login under /anyTenant/file, the referenced file contents themselves can be downloaded anonymously once the metadata has been harvested. Publicly available exploit code exists, but the impact is confined to confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), making this a genuine but moderate-priority access-control issue rather than a critical remote-code-execution threat.
OS command injection in Tuleap Enterprise Edition versions 17.0 through 17.5 allows an authenticated, low-privilege user to execute arbitrary commands on the underlying server, delivering a full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the assessed vector specifies PR:L, exploitation requires a valid account on the target instance - a registered project or site user is sufficient - and no user interaction is needed once that access is obtained, so unauthenticated attackers cannot trigger it directly. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied in the source data. Practical risk is therefore concentrated on internet-reachable Tuleap Enterprise Edition instances in the 17.0-17.5 range that allow self-registration or broad account provisioning, since such deployments effectively lower the credential barrier to exploitation.
Authenticated users of Blinko through version 1.8.8 can achieve remote code execution as root by supplying a plugin name containing '../' sequences to the plugin.installPlugin tRPC procedure, which constructs the install path from the unsanitized name and writes downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an attacker can overwrite a root-owned startup file and gain code execution at the highest privilege level; the endpoint is open to any authenticated account and the referenced sign-in code indicates self-registration may be enabled, potentially letting an unauthenticated outsider obtain the required account. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8), reflecting a genuine high-priority issue rather than a CVSS-inflated paper risk; no confirmed active exploitation is indicated by CISA KEV, though the references include a public repository dedicated to this path-traversal RCE chain that should be treated as potential exploit material.
Authenticated content editors on Grav CMS sites running the Git Sync plugin versions 1.0.2 through 3.4.12 can execute arbitrary OS commands as the web-server account when the plugin's gravuser or gravfull author mode is enabled, by planting shell substitution payloads in their username, full name, or email profile fields that are later interpolated into a git commit --author call and reach PHP exec(). The vulnerability is rated 8.7 (CVSS 4.0) and maps to CWE-78; the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation requires authenticated, low-privileged editor access but no victim interaction, with the additional gating condition that author mode must be explicitly turned on and must not be left at its default posture. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is a credible, prioritizable bug rather than a drop-everything emergency - though any site with untrusted or broadly provisioned editor accounts and author mode enabled should treat it as an immediate command-execution risk.
Local privilege escalation in Samsung's WSM service lets a malicious or compromised process already running on the device trigger a use-after-free and execute arbitrary code with system-level privileges. The flaw affects Samsung mobile firmware builds released before SMR Oct-2026 Release 1; remote network exploitation is not possible because the attacker must first have local code execution able to reach the WSM interface. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but the cross-boundary impact (scope change with high confidentiality, integrity and availability impact) makes prompt installation of the October 2026 security maintenance release the priority for any unpatched device.
Code for IBM i (vscode-ibmi) releases before 3.0.1 install and later execute IBM i component programs without verifying their integrity, so an authenticated attacker holding a separate local account on the same IBM i system can modify a component such as GETMBRINFO when it was deployed with permissive *PUBLIC authorities, and the altered program then runs in the context of any user who subsequently connects through the extension. The reported CVSS 4.0 score is 8.9, but the independent assessment rates the issue CVSS 3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires valid local IBM i credentials, a loosely secured component object, and a victim initiating a connection that triggers the tampered program; no public exploit code or confirmed active exploitation was identified at time of analysis. Version 3.0.1 fixes the flaw, with details in GHSA-rmqv-7c5v-wvjc.
Configuration-validation bypass in Nginx UI (versions 2.0.0-rc.6 through 2.4.0) lets an authenticated low-privilege user write arbitrary nginx configuration directives through the MCP tool nginx_config_add, which persists the file and triggers an nginx reload without ever calling config.ValidateConfigFile - the guard the REST endpoint POST /api/configs does invoke. Because blocked directives such as perl, js_import, load_module and user root can therefore be injected, an attacker on a host with the nginx Perl, njs or Lua module loaded can escalate this into post-authentication remote code execution; on hosts without a scripting module the effect is arbitrary config tampering and reload. The issue is fixed in Nginx UI 2.4.1, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Authenticated remote code execution in IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 arises from improper validation of file paths inside archives the platform extracts, allowing an attacker with a valid account to write files to arbitrary locations and execute code under the privileges of the TRIRIGA service (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is network-reachable with no user interaction and low complexity, but the PR:L vector gates it behind an existing authenticated session, confining realistic exploitation to insiders or attackers who have already obtained platform credentials. No public exploit identified at time of analysis, and IBM has published a vendor patch advisory covering the affected 5.0.0-5.0.8 range.
Authenticated back-office users of Thelia through 2.6.1 can chain a path traversal flaw in the translation editor with a PHP string-escaping failure to write and execute arbitrary PHP code on the server, achieving remote code execution with web-server privileges. The attack requires a back-office account holding UPDATE-level permission on the admin.configuration.language resource (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, assessed 8.8), so it is not reachable by unauthenticated or low-privilege users despite the network attack vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.47% (39th percentile), making this a high-impact but moderate real-world priority.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an attacker who already holds valid low-privilege credentials (CVSS PR:L, AV:N, UI:N) to run arbitrary operating system commands on the underlying host, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). The root cause is improper neutralization of special elements used in an OS command (CWE-94), meaning user-supplied input reaches a shell command without adequate sanitization. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV), but a vendor patch is available per IBM's advisory, so unpatched 5.4.0.0 deployments exposed to multi-tenant users or broadly provisioned accounts should be prioritized for upgrade.
Remote code execution in ManageIQ (and its downstream Red Hat CloudForms) is possible because the YamlLoadAliases module overrides YAML.safe_load so that in production a Psych::DisallowedClass error silently falls back to YAML.unsafe_load, deserializing arbitrary Ruby objects. An authenticated attacker holding dialog import privileges (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) can upload a crafted YAML dialog payload containing a disallowed class to trigger an unsafe deserialization path with full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but Red Hat CloudForms has reached End of Life and no errata will be issued, so CloudForms operators cannot patch and must depend on restricting the dialog import role.
Nginx UI installations before 2.4.1 expose two account-security endpoints, POST /api/otp_enroll and POST /api/finish_passkey_register, that let an attacker holding a stolen, valid JWT bind an attacker-controlled TOTP secret or register an attacker-controlled passkey against the victim's account, producing persistent access that survives a password change. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires an authenticated session rather than being unauthenticated, and no public exploit code has been identified at time of analysis. The TOTP path only succeeds if the victim has not already enabled TOTP, because it relies on an existing-enrollment guard, whereas the passkey registration path has no equivalent guard and is exploitable regardless of prior enrollment.
Remote OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated attacker holding only low-privileged credentials to run arbitrary operating system commands on the underlying DataStage host, with high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is an OS command injection (CWE-78) in which specially crafted input is passed to a system command without proper neutralization, so no user interaction is required and a single crafted request over the network is sufficient once valid access is obtained. Exploitation is gated by the need for existing credentials on the instance, and there is no public exploit code identified at time of analysis; IBM has published a fix via support node 7288649.
Persistent code execution on a penetration tester's workstation is achievable through a relative path traversal (CWE-22) in the Metasploit Framework post module post/apple_ios/gather/ios_image_gather, affecting versions prior to 6.5.5. A hostile or tampered iOS device can return a crafted directory-listing entry (for example ../../msfconsole.rc) that the module interpolates without sanitization into the local destination path handed to client.fs.file.download_file(), overwriting ~/.msf4/msfconsole.rc, which every msfconsole invocation automatically executes at startup; because the written resource file can load a second written Ruby plugin, this converts into an interactive shell as the operator (frequently root) at the next console launch. Exploitation is not remote-unauthenticated against a default service: it requires operator interaction (UI:R) to run the specific gather module against an attacker-controlled Meterpreter session, no workstation authentication (PR:N) is needed, and the assessed attack complexity is High because the hostile device, the specific module, and the resulting file write must all align; no public exploit code was identified at time of analysis, and the flaw is fixed in the 6.5.5 release.
Configuration validation bypass in Nginx UI (nginx-ui) prior to 2.4.1 lets an authenticated user with configuration-write privileges inject restricted Nginx directives by placing a benign directive first on a single line and appending a semicolon-separated restricted directive such as load_module, js_import, perl, or user root, because ValidateConfigDirectives only inspects the first token of each newline-split line. The flaw affects the REST, nginx_config_modify, site, and stream write paths and can escalate to arbitrary code execution in the Nginx worker context when a loadable Nginx module is already present on the host, a precondition that limits practical impact. No public exploit code was identified at the time of analysis, and the vendor released patch version 2.4.1.
Authenticated users of Nginx UI (0xJacky/Nginx-UI) prior to 2.4.1 can bypass the built-in nginx directive validation and write arbitrary nginx configuration through the MCP tool nginx_config_add, which reloads nginx with the injected directives. Where nginx is built with the njs or perl module (as in the official Docker image), an attacker - or an MCP-enabled AI agent steered by prompt injection - can achieve code execution on the nginx host with the privileges of the nginx worker process. The CVSS score of 8.8 reflects a network-reachable, low-complexity path requiring only authenticated MCP access (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), making this a credible, actionable priority rather than a paper-high CVSS; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Unauthenticated username-change in ZITADEL's hosted Login V1 UI lets a remote attacker rename any active human account - including administrators - by supplying only the victim's login name, locking legitimate users out of the identity provider. The underlying defect is CWE-306 (missing authentication for a critical function): the change-username handler acts on the account bound to the login flow before any authentication factor is verified, so deployments running ZITADEL 3.0.0 through 4.17.x with Login V1 enabled are exposed, while instances on a newer login flow or already upgraded to 4.18.0+ are not. No public exploit identified at time of analysis and no CISA KEV listing applies; the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L describes a high-integrity, low-availability impact bounded to the Login V1 population, consistent with the VulnCheck-reported CVSS 4.0 score of 8.8.
Improper authentication in IBM Planning Analytics 2.0 and 2.1 allows an attacker who already holds valid low-privilege credentials to escalate to unauthorized administrative access over the network, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, CWE-288). Because the vector carries PR:L, the flaw is not reachable by a fully unauthenticated outsider: the attacker must first obtain ordinary authenticated access to the deployment, after which the alternate-path authentication weakness grants administrative control. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but IBM has published a vendor patch, so the primary risk is unpatched, internet- or partner-reachable Planning Analytics installations where low-privilege accounts are widely distributed.
Unsafe deserialization in the UYAP Document Editor before version 5.4.20 allows an attacker to inject objects into the application through a crafted document, resulting in code execution with the privileges of the editor process (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-502). Exploitation is unauthenticated and network-reachable with low complexity, but requires the victim to open or process an attacker-supplied malicious document (UI:R), which is the principal limiting factor; no public exploit has been identified at time of analysis, and the product is deployed specifically within the Turkish judicial (UYAP) user base, narrowing the realistic target set. Successful exploitation yields high confidentiality, integrity, and availability impact within the affected user's scope.
Server-side request forgery in the SearxNG-backed search tools shipped with the praisonaiagents Python package before 1.6.62 lets prompt-injected content hijack the agent's outbound HTTP requests and read the responses back into the model's context, enabling internal service and API disclosure plus internal host/port enumeration. The vulnerable sink is the LLM-exposed searxng_url tool parameter, which is forwarded to requests.get() without any validation of scheme, host, port, or resolved address; search_web and searxng_search are part of the default agent tool profile, so any agent that ingests attacker-controlled web pages, files, or upstream tool output is in scope. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L (8.8) - no authentication is needed (PR:N), but exploitation depends on the agent actually processing malicious content and the model complying with the injected tool call (UI:R); confidential impact is high while integrity and availability impact are low. No public exploit identified at time of analysis; in cloud deployments the same primitive can reach the instance metadata endpoint (169.254.169.254) and potentially expose IAM credentials, though that requires the instance metadata service to be reachable from the agent's network position.
Path traversal in the OTRS SendSupportBundle functionality allows an authenticated administrator to delete files outside the intended directory, limited by the operating system permissions of the OTRS application process. The issue affects OTRS versions 7.0.X through 2026.X before 2026.7.X, as well as ((OTRS)) Community Edition 6.x and earlier; products based on Community Edition are likely affected. Despite a high CVSS score of 8.7, exploitation requires a valid administrative account and does not bypass OS file permissions, and no public exploit has been identified.
Server-side template injection in the back-office Email/Messages feature of Thelia 3.0.0 lets an authenticated user holding the 'Messages' permission submit unsandboxed Twig templates that the application compiles and executes as raw PHP, enabling arbitrary function calls, sensitive file reads, and potential filesystem writes that can compromise both the application and its underlying host. Exploitation requires valid back-office credentials plus the 'Messages' privilege (CVSS vector PR:L), so there is no anonymous or mass-exploitation path; EPSS is low at 0.19% (8th percentile) and no public exploit code or CISA KEV entry has been identified, though the flaw is remotely triggerable and rated 8.8 for its high confidentiality, integrity, and availability impact once the privilege prerequisite is met. The vendor has shipped a fix in thelia/twig-engine-module 1.0.9.
Command injection in the IBM Maximo Application Suite 'Location Service for Esri' component (versions 9.0, 9.1 and 9.2) allows a highly privileged attacker to execute arbitrary shell commands through a Kubernetes operator task, compromising confidentiality, integrity and availability beyond the component's own security boundary (CVSS 8.7). Exploitation is access-gated rather than trivial: the optional Esri location component must be deployed and enabled, and the attacker must already hold high privileges in the MAS environment (PR:H), but once those two conditions hold there is no user-interaction requirement and attack complexity is low, so injection is straightforward. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Cross-origin requests to the obsidian-tc Model Context Protocol HTTP transport let any web page a victim visits read from and write to the entire Obsidian vault, because releases before 1.3.1 performed no Host or Origin header validation and ran with DNS-rebinding protection disabled. The issue affects deployments that run the Streamable HTTP transport bound to loopback under the documented auth.mode 'none' configuration, where inbound requests receive full wildcard vault scopes; the attacker needs remote, unauthenticated reach via the browser (PR:N) but must convince the victim to load an attacker-controlled page while the server is running (UI:R), yielding high confidentiality and integrity impact (CVSS 8.8, CWE-346). No public exploit was identified at time of analysis, and exploitation does not apply to server-to-server MCP clients (which send no Origin header), to deployments that configure any authentication mode other than 'none', or to version 1.3.1 and later, where host, origin, and DNS-rebinding validation are enabled by default.
Privilege escalation in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 allows a local low-privileged attacker to gain elevated privileges on the Db2 host when the db2locssh feature is enabled. The vulnerability is not remotely reachable and requires an existing local account, making it a post-foothold escalation vector rather than a remote entry point. No public exploit code has been identified at the time of analysis, and IBM has released patches; this is a credible operational priority for environments with db2locssh enabled, but not an emergency.
Privilege escalation in IBM Db2 LUW (versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows, including Db2 Connect Server) lets a locally authenticated low-privilege user elevate to higher privileges through improper privilege management, with high impact to confidentiality, integrity and availability and a scope change that can affect resources beyond the vulnerable component. Exploitation is constrained: the attacker must already hold a local foothold on the host and valid low-privilege credentials (CVSS vector AV:L/PR:L/UI:N), so this is not reachable by a remote unauthenticated adversary and realistically affects insiders or attackers who have breached another service on the same host. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available, making this a credible, actionable priority for exposed Db2 LUW estate rather than an emergency.
Memory exhaustion denial of service in SGLang through 0.5.21 allows unauthenticated remote attackers to override the GLM-V video-processing resource budget by supplying attacker-controlled fps, max_frames, max_tokens_per_frame, and max_image_tokens values inside the video_url object of an inference request, causing glm4v.py to decode every frame of a high-resolution video at full size until worker memory is exhausted. Per CVSS PR:N in both the vendor-supplied CVSS 4.0 vector and the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the request path requires no authentication from the base vector, although in practice the endpoint is often fronted by a proxy or network boundary. Exploitation is limited to deployments serving a GLM-4V (GLM-V) multimodal model that accept video_url inputs; impact is availability only, with no code execution or data exposure, and no public exploit identified at time of analysis (no CISA KEV entry, no POC referenced).
Authenticated code injection in Craft CMS 4.x and 5.x allows a control panel user holding the performUpdates permission (or access to the Updates utility) to execute arbitrary code on the server by submitting a crafted 'updates' request to AppController::actionCacheUpdates. The endpoint forwards the raw request parameter into UpdatesModel without applying Component::cleanseConfig(), so an attacker can inject Yii behavior and event-handler configuration keys such as 'as' or 'on' - for example an AttributeTypecastBehavior gadget - and achieve remote code execution. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (High, 8.7 in the vendor's CVSS 4.0 scoring), and no public exploit code was identified at time of analysis; the practical barrier is the privileged-account requirement, which limits realistic exposure to malicious insiders, over-provisioned admin accounts, or environments where a control panel credential has already been compromised.
Remote code execution affects Craft CMS 5.10.2 up to but not including 5.10.14, where the Twig sandbox fails to block PHP callables passed to the 'has some' and 'has every' operators inside sandboxed system-message templates. Exploitation requires an authenticated control-panel account that has been granted the System Messages permission - a permission that can be delegated to non-admin users - after which the attacker can invoke two-argument functions such as passthru or system and execute code with the privileges of the web server user. Per current intelligence there is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the permission gate is the main limiter, so deployments that reserve System Messages for trusted administrators face materially lower practical risk than multi-user or agency installations that delegate that permission broadly.
Denial of service in SGLang through 0.5.21: unauthenticated remote attackers can exhaust server memory and CPU by submitting tiny, highly compressed FLAC files (typically pure digital silence) through the audio_url or audio_data inputs of the multimodal audio pipeline, which decodes them into enormous PCM buffers with no duration or sample-count ceiling. The issue is scored 8.7 under CVSS 4.0 (and AV:N/AC:L/PR:N/UI:N/A:H under CVSS 3.1) with availability impact only and no confidentiality or integrity impact, and no public exploit code was identified at time of analysis. Exposure is bounded: only deployments that actually serve an audio-capable multimodal model and accept attacker-supplied audio without authentication, request limits, or resource caps can be driven into memory exhaustion, making this a genuine but configuration-dependent availability risk.
Remote unauthenticated attackers can crash PHP worker processes in applications using Gumlet php-image-resize before 3.0.1 by submitting small, heavily compressed image files that expand into very large bitmaps when decoded by GD, exhausting the PHP memory limit and terminating the worker. Any upload or URL-fetch feature that hands untrusted images to the ImageResize constructor is exposed; the impact is availability-only, affecting individual PHP-FPM workers rather than enabling code execution or data disclosure. Severity is rated 8.7 (CVSS 4.0) and an independent assessment concurs on a high availability impact (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, but the attack is trivial to construct and the vendor characterizes this as a genuine availability risk rather than an emergency.
Memory exhaustion in modern-tar versions 0.3.5 through 0.8.5 lets remote, unauthenticated attackers crash or stall any process that unpacks an attacker-supplied tar archive, because a size field containing a non-octal byte (such as '/', '8', '9' or ':') is parsed by readOctal() into a negative entry size that the unpacker then buffers against indefinitely - the malicious archive may also be gzip-compressed. The impact is availability only (CVSS 4.0 8.7, assessed CVSS 3.1 8.1 with VC:N/VI:N/VA:H): no code execution or data disclosure is demonstrated, and the upstream 'Information Disclosure' tag is not supported by either vector. No public exploit code and no CISA KEV entry were identified at time of analysis; the practical limiting factor is exposure and configuration, since deployments that enable the library's strict parsing mode, or that only unpack trusted archives, throw on the malformed header instead of buffering and are not realistically exploitable.
Remote, unauthenticated denial of service in Zcash Foundation's Zebra full node: versions 6.4.0 through 6.4.1 abort when a peer sends a single version-6 transaction that carries a pre-NU6.3 consensus branch ID (Nu5/Nu6/Nu6.1/Nu6.2), because the malformed Orchard bundle cannot be re-serialized during UnminedTx size computation and the resulting error trips an `expect()` that terminates zebrad. The malicious `tx` message is accepted pre-handshake, so the attacker needs only network reachability to the node's P2P port, no credentials or completed peer negotiation, and the crash can be repeated after every restart for sustained unavailability; no public exploit code was identified at time of analysis, but the trigger is a trivial single message and the flaw is specific to Zebra 6.4.0-6.4.1 (patched nodes reject the transaction at parse time).
Unauthenticated memory exhaustion in SGLang through 0.5.21 lets remote attackers crash the HTTP/tokenizer worker and deny service by sending concurrent oversized multipart uploads to the /v1/audio/transcriptions endpoint, which reads each uploaded file fully into memory before validating its size. The flaw is CWE-770 (allocation of resources without limits or throttling) and is scored 8.7 under CVSS 4.0, with the independent assessment confirming CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H. No public exploit identified at time of analysis, and the impact is availability-only: no confidentiality or integrity loss, and the service can be restarted once the flood stops.
Memory-exhaustion denial of service in SGLang (all versions through 0.5.21) allows remote, unauthenticated attackers to crash inference workers by submitting small, highly compressed images with enormous pixel dimensions to the image loader. The root cause is that NanoNemotronVLImageProcessor sets Pillow's Image.MAX_IMAGE_PIXELS to None, a process-wide global that disables decompression-bomb protection for the entire worker, including the generic image-loading path used by other models. Per the independent assessment this is a genuine but bounded availability risk: it only affects deployments that actually load NanoNemotronVLImageProcessor, and there is no public exploit identified at time of analysis. EPSS and CISA KEV data were not provided, so active exploitation is not confirmed.
Denial of service in SGLang through 0.5.21 lets remote attackers exhaust worker memory by submitting high-resolution video content to the OpenAI-compatible /v1/chat/completions endpoint on Qwen-VL multimodal deployments, with concurrent requests multiplying the allocation until the inference worker or host runs out of RAM. The root cause is preprocess_video in python/sglang/srt/multimodal/processors/qwen_vl.py (lines 267-306), which decodes every frame at full source resolution before the max_pixels downscaling limit is applied, so the documented memory cap does not constrain the expensive decode step. Severity is rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, C/I integrity unaffected) and the assessed CVSS 3.1 equivalent is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis, no CISA KEV listing, and real-world priority is moderate and tightly scoped because the practical limiting factor is exposure of the inference endpoint rather than exploitation difficulty.
Unauthenticated multipart uploads to the LogicalDOC Community Edition /upload endpoint (through version 9.3) let remote attackers write files into application temporary directories that are never cleaned up, exhausting server disk space and degrading or halting the document management service. The UploadServlet accepts file parts without a valid session and imposes no limit on the number of parts per request, so no credentials, user interaction, or non-default configuration are needed - only network reachability to the endpoint. Impact is confined to availability (integrity and confidentiality are unaffected, per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector), no public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
An incorrect authorization flaw in the WinBox authentication flow of MikroTik RouterOS lets a remote authenticated attacker who holds valid credentials for a low-privilege, WinBox-permitted account take over the authorization policy of a different, higher-privileged account such as admin. The EC-SRP stage-one challenge and proof are validated against the attacker's own account, but the separately supplied stage-two username determines which privilege policy gets installed, so the attacker ends up with a full administrative session without ever knowing the admin password, and can then use it to elevate their own account. Coverage across ENISA and CERT.LV reporting with a CVSS 4.0 score of 8.7 indicates a high-severity, network-reachable issue; no public exploit code has been identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires one valid low-privilege WinBox-enabled credential and network reachability to the WinBox service.
Unauthenticated information disclosure in Grav CMS 2.0.22 through 2.1.6 lets attackers read sensitive Clockwork profiler records - including system and plugin configuration, secrets, request metadata, and database queries - when the profiler is active and the site sits behind a same-host HTTP proxy. The flaw is an authentication bypass: the profiler treats any request whose REMOTE_ADDR is a loopback address (e.g. 127.0.0.1) as an authorized local client, so requests forwarded through a co-located proxy inherit that trust. Exploitation is conditional rather than trivial - the profiler is a debug feature and must be enabled, and the attacker must be able to reach the application through the loopback-presenting proxy path; no public exploit code was identified at time of analysis, and this is not a CISA KEV entry. The impact is confidentiality-only (no integrity or availability effect) and is best characterized as a genuine but conditional disclosure flaw rather than a blanket high-severity emergency.