Out-of-band XML External Entity (XXE) injection in Eclipse JAXB RI (jaxb-ri) lets an unauthenticated remote attacker read local files when an application unmarshals attacker-influenced XML through the affected JAXB factory helpers (XmlFactory in the core and xsom modules). The pre-patch code relied solely on XMLConstants.FEATURE_SECURE_PROCESSING, so on JAXP/SAX/DocumentBuilder implementations where that single feature does not disable DOCTYPE declarations, external general entities, external parameter entities, or external DTD loading, external entity resolution remains possible and file content can be exfiltrated out-of-band. Exploitation requires both conditions to hold - untrusted XML reaching JAXB unmarshalling, plus a parser stack where secure processing alone is insufficient - which is why the vector carries AC:H and the score is 8.3 (High) on both the supplied CVSS 4.0 vector and the independently assessed CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L). No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis.
Nginx UI versions prior to 2.4.1 fail to enforce the RequireSecureSession step-up check on multiple authenticated mutation endpoints, so an attacker who already holds a valid session token for an OTP- or passkey-enabled account can create or modify automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without ever supplying a fresh X-Secure-Session-ID. The flaw is a missing-authorization-check class issue (CWE-862) rated CVSS 3.1 base 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H): it requires a stolen or otherwise obtained authenticated session (PR:L) but no user interaction, giving high integrity and availability impact. No public exploit code was identified at time of analysis and there is no indication the issue is being actively exploited; the upstream fix is available in release 2.4.1.
Path traversal in IBM Planning Analytics 2.0 and 2.1 allows a remote attacker to read arbitrary files from the host and overwrite certain application files by supplying crafted file paths to the service. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base 8.2) confirms network reachability, low attack complexity, no authentication requirement (PR:N), and no user interaction, with high confidentiality impact and limited integrity impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor has released a fix referenced in the IBM advisory.
Denial of service in Parse Server allows remote attackers to crash the Node.js process by writing an object that contains a file reference without a URL into a class that has Cloud Code save/find/delete triggers or LiveQuery enabled. Unauthenticated exploitation is possible only where the deployment allows public write access or open sign-up; instances enforcing authenticated writes via ACLs or Class-Level Permissions require an account with write rights, so exposure is bounded. The flaw is an uncaught exception (CWE-248) that terminates the server process and can break subsequent requests until restart. No public exploit code was identified at time of analysis, and impact is confined to availability (no confidentiality or integrity loss).
A malicious RDP client can crash a FreeRDP-based RDP server running versions before 3.32.0 by negotiating the NSCodec and requesting an oversized desktop geometry, which forces a buffer-growth allocation failure inside nsc_context_initialize_encode() and leaves dangling plane pointers that are later double-freed during context teardown. The impact is availability-only - no code execution, data exposure, or persistence - and the attack is unauthenticated (CVSS PR:N), but success depends on actually inducing the allocation failure, so the trigger is not perfectly deterministic and the vulnerable server-mode deployment is less common than FreeRDP's client-side use. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a moderate-priority crash issue rather than the more alarming 8.2 CVSS 4.0 base score suggests.
Memory corruption in IBM Power Systems host firmware FW1060.00 through FW1060.81 lets an attacker who already holds authenticated, high-privileged service-level access to the Flexible Service Processor (FSP) write crafted configuration data that corrupts the host firmware boot stack during system IPL, with the compromise then propagating to the hypervisor loaded by that firmware and to the managed system. Because the flaw is reachable only from the local FSP interface (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) and only fires on a (re)boot cycle rather than at runtime, the practical attack path is an insider or compromised FSP service account on the management plane rather than a remote network attacker, and no public exploit identified at time of analysis and no CISA KEV listing is associated with this CVE. Full confidentiality, integrity, and availability impact is scored against the managed system, with a scope change reflecting that the corruption begins in host firmware but affects the separately-managed hypervisor.
Authenticated attackers holding service-level credentials on the Flexible Service Processor (FSP) can read or modify arbitrary regions of Hostboot memory on IBM Power Systems firmware levels FW1060.00 through FW1060.81 by sending a specially crafted message over the service processor mailbox interface, corrupting the host firmware boot stack and the hypervisor it subsequently loads. The flaw is rated CVSS 8.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), with the scope-change rating reflecting that the FSP compromise crosses a boundary into host firmware and produces high confidentiality, integrity, and availability impact on the managed system. Exploitation is gated behind high-privilege service-processor access rather than network reach to the managed OS, and no public exploit code has been identified at time of analysis; no EPSS score was supplied, so it could not be factored into the risk picture.
Local code execution in IBM Power Systems firmware (FW1060.00 through FW1060.81) lets an attacker who already holds authenticated service-level access to the Flexible Service Processor (FSP) send a crafted service processor mailbox message that overflows host firmware runtime attribute storage, compromising the managed system's memory and hardware interfaces. The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (base 8.2) is internally consistent with that description: the flaw is local, requires high-privilege service-plane credentials, needs no user interaction, and its scope change reflects a jump across the trust boundary from the service processor into the host firmware runtime with high confidentiality, integrity and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; IBM published the vendor advisory at https://www.ibm.com/support/pages/node/7290126.
Arbitrary code execution on the host system is possible in IBM Power Systems firmware versions FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81, due to a stack-based buffer overflow (CWE-121) in the host firmware boot process image validation path. An attacker with high-privileged service access to the service processor (PR:H, AV:L) can supply a maliciously crafted code update image to execute arbitrary code on the host system, resulting in full confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.2, High). No public exploit has been identified at time of analysis, and exploitation requires local/service-level access and high privileges, substantially limiting real-world risk.
Arbitrary code execution in the host firmware runtime of IBM Power Systems is possible via the service processor mailbox interface, affecting firmware levels FW1060.00 through FW1060.81. An attacker with authenticated service-level access to the Flexible Service Processor (FSP) can send a crafted mailbox message that overflows host firmware runtime attribute storage (CWE-121), gaining full access to the managed system's memory and hardware interfaces. This is a high-severity local/management-plane issue (CVSS 8.2) requiring high privileges; no public exploit has been identified at time of analysis, and while it is not a mass-exploitation priority, isolation of the FSP network and limiting service accounts are recommended.
NetEase Cloud Music for Windows versions 3.1.38 and 3.1.39.205426 accept forged API responses because /eapi/ and /xeapi/ bodies are decrypted with a fixed AES-128-ECB key and no integrity credential. A network-positioned, unauthenticated attacker (MITM, rogue proxy, or spoofed DNS/ARP) can construct valid ciphertext with PKCS#7 padding, achieving high integrity impact (VI:H) on the client's data flow. The flaw alone only enables forged-response acceptance and requires chaining-such as to the os.navigateExternal bridge-for meaningful exploitation; no public exploit code or active exploitation has been identified at time of analysis.
Path traversal in ConvertX (all releases prior to 0.18.0) lets an authenticated user write converted output files to arbitrary paths inside the container by supplying traversal sequences in the convert_to parameter of the /convert endpoint. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H reflects that exploitation requires a valid account by default, though instances deliberately configured for unauthenticated access lower that bar to anyone who can reach the service; the payoff is integrity and availability impact - overwriting files or causing denial of service - rather than data disclosure. A vendor fix is available in 0.18.0 (upstream PR 532, commit 0965928), and no public exploit code or confirmed active exploitation was identified at time of analysis, keeping this a credible above-average-priority issue rather than a top-tier emergency.
Credential exposure in Telegram-Stremio through 5.1.0 lets any party with read access to the addon's MongoDB database, its backups, or its application logs recover the operator's stored Telegram session string by running it through the project's own keyless decode_string routine, granting full control of the linked Telegram account even when two-step verification is enabled. Only deployments that have completed a Telegram login (so a session string is actually persisted) are affected, and exploitation is not remotely triggerable against a default running service: the CVSS 4.0 vector carries AT:P, reflecting the prerequisite that the attacker already holds read access to a backend data store holding the string. The published CVSS 4.0 score is 8.2 (High) with confidentiality as the sole impacted metric, no public exploit code has been identified at time of analysis, and the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Out-of-bounds reads in the IBM i File Server allow a remote authenticated attacker to crash or disrupt the service while also leaking portions of adjacent memory, affecting IBM i releases 7.3, 7.4, 7.5 and 7.6. Exploitation is not unauthenticated: the CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that valid low-privilege credentials and network reachability to the File Server are both required, with high confidentiality and availability impact but no integrity impact, and no user interaction. No public exploit code has been identified at time of analysis, EPSS is low at 0.41% (33rd percentile), CISA SSVC rates exploitation as none and the issue as not automatable, and a vendor patch is available, so this is a moderate-priority patching item rather than an emergency.
Authenticated remote code execution in IBM Planning Analytics 2.0 and 2.1 stems from a stack-based buffer overflow (CWE-121) that allows a remote attacker holding valid low-privilege credentials to corrupt stack memory and execute arbitrary code. IBM assigns a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), and the independent assessment raises the availability impact to High, indicating a successful exploit may also crash or destabilize the affected service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor patches are available via IBM support node 7291604.
Session token disclosure in IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 allows a remote authenticated attacker to read session tokens that are rendered directly into HTML response bodies, which can enable session hijacking of whichever account owns the exposed token. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, so exploitation requires a valid low-privileged account and the confirmed impact is loss of confidentiality, not direct integrity or availability damage; the practical severity depends on whether tokens belonging to higher-privileged users are exposed rather than only the attacker's own session, in which case impact is minimal. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available per the IBM advisory.
MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 can write security-sensitive values - information that enables access to protected resources - into diagnostic logs when the server is running in specific, non-default configurations. Anyone who can already read those logs (filesystem access, a log-aggregation/SIEM pipeline, backup or archive copies, or an account permitted to view logs) can harvest that data and use it to obtain unauthorized access, so the exposure is genuine but gated on two preconditions: a particular logging configuration must be present, and the attacker must already hold low-privileged log read access. No public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis, and the independent assessment rates this as a confidentiality-only, local-context issue (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), making it a moderate-priority hardening problem rather than an emergency despite the 8.1 vendor score.
Authorization bypass in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated attacker who already holds tracker administration rights on one tracker to update or delete fields belonging to other trackers on the same instance. The flaw is a CWE-639 user-controlled key authorization bypass rated CVSS 8.1 with high integrity and availability impact, but it requires a low-privilege tracker-admin role (PR:L) and affects only the stated versions. No public exploit identified at time of analysis, and no confirmed active exploitation, though practical risk is highest in large multi-team deployments where many trackers share one instance.
Cross-site request forgery in ConvertX versions prior to 0.18.0 lets an attacker permanently delete an authenticated user's conversion jobs by luring that user into loading attacker-controlled content that silently requests /delete/{id} over HTTP GET. Because the deletion route performs a state-changing action without a CSRF token and job identifiers are simple sequential integers, an <img> or <iframe> src pointing at a guessed id is enough to trigger deletion with the victim's session cookie attached, with no click required. Exploitation requires an active victim session and the victim viewing attacker-controlled content; impact is confined to the victim's own job history (the provider scores this 8.1 with I:H/A:H, while our assessment rates the impact as limited, I:L/A:L), no public exploit code has been identified, and CISA KEV does not list this issue. The flaw is fixed in version 0.18.0, which converts the endpoint to POST and switches the UI to form-based submission.
Nginx UI versions prior to 2.4.1 let an authenticated, OTP-enabled user holding only an ordinary JWT - without the X-Secure-Session-ID step-up header - create or modify Nginx configuration and trigger reload behavior by calling the nginx_config_add and nginx_config_modify tools through the /mcp and /mcp_message endpoints, which were protected by ordinary authentication alone. The equivalent HTTP configuration mutation routes correctly enforced the RequireSecureSession middleware, so the MCP channel constituted an alternate path around that control (CWE-288). Per the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, impact is limited to integrity and availability with high severity driven by unconstrained config writes; exploitation requires an existing low-privilege authenticated session on a pre-2.4.1 instance, and no public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in version 2.4.1, and the upstream commit additionally hardened backup-related routes with RequireSecureSession.
Cross-site request forgery in the Patreon WordPress plugin (slug patreon-connect) through version 1.9.17 allows an attacker to craft a request that a logged-in WordPress administrator may submit without intent, because the affected functionality lacks anti-CSRF nonce validation. The independent assessment rates this as integrity-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), lower than the 8.1 score reported elsewhere, and notes that the signals are thin and partly conflicting; exploitation requires a logged-in privileged user (typically an administrator) to visit attacker-controlled content or click a crafted link. No public exploit code and no CISA KEV entry were identified at time of analysis, and the attacker gains only the privileges of the victimized session.
Memory corruption through a use-after-free (CWE-416) in the JavaScript engine integration of Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 can lead to controlled process failure, server instability, or corrupted memory state. Exploitation is not anonymous: the assessed vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) requires a high-privileged account that can already execute server-side JavaScript, and the high attack complexity indicates the defect depends on specific timing or state conditions that are not reliably achievable on demand - so realistic abuse is confined to trusted, insider, or post-compromise contexts. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released fixed versions 12.1.0 (12.x track) and 11.3.7 (11.x track).
OS command injection in the Ministry of Justice General Directorate of Information Technology's UYAP Document Editor before version 5.4.20 allows an attacker to execute arbitrary operating-system commands on a victim's machine when a crafted document is opened in the application. The issue is local in nature (AV:L) and requires user interaction (UI:R) - the victim must open a malicious file - but no authentication or privileges are needed (PR:N), and successful exploitation yields high confidentiality, integrity, and availability impact, giving a base score of 7.8 (HIGH) on the CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The flaw was reported by TR-CERT; no public exploit code has been identified and the issue is not listed in CISA KEV, so the practical risk is driven by phishing-style delivery of weaponized-looking documents rather than by remote scanning or automated mass exploitation.
Use-after-free in the Linux kernel sched/cache LLC grouping code can let a local attacker crash the kernel or potentially corrupt memory by racing a task mm switch against account_mm_sched() accessing the old mm's scheduling statistics. Only recent 7.2+ kernels that include the sched/cache feature are affected; the flaw is fixed in Linux 7.2.9 and 7.3-rc5. Exploitation requires local code execution and a tight cross-CPU timing window, EPSS is 0.14% (3rd percentile), and no public exploit has been identified at time of analysis.
Use-after-free in GNOME Mutter's Wayland color-management (wp_image_description_v1) path allows a local, authenticated attacker who can run a malicious Wayland client to destroy the image-description resource while an asynchronous ICC file read is still in flight, after which the compositor writes into freed memory and frees a pointer derived from it - typically crashing the GNOME session and potentially enabling code execution inside the compositor process. The flaw is local-only and timing-dependent (it requires winning a race window), only applies to Wayland sessions where the color-management/ICC path is exposed (not X11-only sessions or builds without that code path), and no public exploit code or CISA KEV entry has been identified at time of analysis; in practice the more likely outcome is a session crash rather than reliable code execution. This is a credible local privilege/code-execution risk but not an urgent internet-facing emergency.
Local privilege escalation in IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 stems from a misconfigured PATH environment variable (CWE-426) that lets a local attacker place a malicious executable in a directory searched before trusted system paths. Exploitation requires an existing low-privileged foothold on the host and a writable directory on the PATH, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/PR:L/UI:N). No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has published a fix.
Privilege escalation in containerd's CRI checkpoint-restore path allows an authenticated local attacker who can submit an attacker-controlled checkpoint archive via CRI CreateContainer to have the restored process run with restored credentials (including root), full capabilities, and restored no_new_privs and seccomp state, while CRI status continues to report the requested ContainerConfig. The flaw affects containerd 2.1.0 through 2.2.6 and 2.3.0 through 2.3.3, and only where CRI checkpoint restore via CreateContainer is actually used; systems that never use this experimental feature are not affected. Rated CVSS 7.8 (High) with a local, low-complexity, authenticated (PR:L) vector, and no public exploit identified at time of analysis. Fixed in 2.2.7 and 2.3.4, where the restore-via-CreateContainer behavior is additionally disabled by default.
Remote code execution in Project MONAI 0.4.0 through 1.6.0 requires an on-path attacker to tamper with SENet pretrained weights fetched over plaintext HTTP, causing construction of SEResNet50 or another SENet model with pretrained=True to unpickle a crafted .pth file because load_state_dict_from_url is used without weights_only=True. The issue is unauthenticated but requires user interaction and a man-in-the-middle position; no public exploit identified at time of analysis. The CVE record rates it CVSS 7.7, though the assessed precondition set makes real-world urgency conditional rather than broadly exploitable.
Authenticated users of IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (including DB2 Connect Server) can obtain sensitive information they are not authorized to see by issuing the CREATE WRAPPER command, which is improperly authorized. The vulnerability is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so it requires a remote attacker to already hold valid Db2 credentials and the privilege to invoke CREATE WRAPPER; there is no integrity or availability impact, making this primarily an insider or compromised-credential risk rather than an unauthenticated breach vector. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but fixed code is available from IBM and should be applied, particularly in environments where federation features are enabled.
Continue CLI through 1.5.47 can be tricked into executing commands outside its approved Bash prefix rules when an unauthenticated attacker injects instructions into repository files or fetched web pages that the agent processes; the agent then chains an unapproved command after ;, &&, or |, resulting in code execution as the user. Exploitation requires that the operator has configured at least one permissive Bash allow rule, that the agent is pointed at attacker-controlled content, and that the victim runs the agent against that content, so default installations without Bash approval rules are not exposed. No public exploit identified at time of analysis; the issue is rated CVSS 7.7 and is a genuine, moderately high-priority concern for users running the Continue CLI agent on untrusted inputs.
Authenticated users of the MarkLogic Query Console can read arbitrary files from the underlying server by supplying unsafe path values to a privileged filesystem helper, a classic path-traversal disclosure (CWE-22). The issue affects MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7, and carries a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), meaning a network-reachable, low-complexity attack by an authenticated principal that yields high confidentiality impact with no integrity or availability effect and a scope change because the helper runs with privileges beyond the caller's own. Because exploitation requires valid Query Console credentials, this is a credible moderate-to-high priority patching item rather than a drop-everything emergency; no public exploit code or confirmed active exploitation was identified at time of analysis.
Insufficient access controls in Progress MarkLogic Server 12.x (before 12.1.0) and 11.x (before 11.3.7) allow a remote, authenticated attacker holding only limited management privileges to read security-sensitive information, which can then be used to reach protected resources outside that account's intended scope. The CVE carries a 7.7 score with a scope-changing vector (S:C) because the confidentiality impact crosses a privilege boundary, but exploitation is gated on the attacker already possessing a valid low-privilege management account (PR:L), and no user interaction is required. No public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exposure concentrates in multi-tenant or role-segmented installations, or as a lateral-movement step after an initial account compromise.
Authenticated users of the Red Hat OpenShift web console can abuse the Helm chart URL input to make the console pod issue requests to arbitrary destinations, turning the console into a Server-Side Request Forgery (SSRF) proxy (CWE-918, CVSS 3.1 base 7.7). Because the console pod typically sits inside the cluster network with broader reachability than the user, a low-privileged console account with the ability to add or load a Helm chart can use leaked error output to read sensitive responses and can perform blind port scanning against internal services. Exploitation requires an authenticated console session and the privilege to supply a chart repository URL (PR:L, unauthenticated outsiders cannot reach it), and the assessed impact is confidentiality-only with no integrity or availability effect; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Unintended outbound network egress in IBM Maximo Application Suite's optional Location Service for Esri Component (versions 9.0, 9.1, and 9.2) stems from a misconfigured Kubernetes NetworkPolicy that fails to restrict pod egress, allowing traffic to reach destinations the deployment intended to block. Rated CVSS 3.1 base 7.7, the score is driven mostly by the Scope change (S:C) and High confidentiality impact (C:H) rather than ease of attack; the vector (AV:N/AC:L/PR:L/UI:N) indicates remote exploitation at low complexity but with the attacker already holding a low-privileged foothold inside the environment, and no user interaction is needed. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not listed), so this is best treated as a moderate-priority network-segmentation and data-exposure issue affecting clusters that rely on the shipped NetworkPolicy for egress control.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 contains an XML external entity (XXE) injection flaw that allows an authenticated attacker holding an elevated/privileged account to read sensitive information from the application server and, through the changed-scope condition in the CVSS vector, potentially from resources beyond the vulnerable component's own security boundary. Network access with low attack complexity and no user interaction is required, but the PR:H privilege requirement confines realistic exploitation to insiders or attackers who have already obtained privileged credentials, making this a moderate-priority issue rather than an emergency; no public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV.
Open WebUI versions 0.6.27 through 0.11.3 forward the entire browser cookie jar - session cookies included - to OpenAI-compatible connections, OpenAPI tool servers, and terminal servers that are configured in OAuth mode, letting the operator of such a destination server capture those cookies from routine requests and replay them to hijack accounts, including administrators. The issue is unauthenticated from the attacker's perspective (CVSS 4.0 7.6; independently assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N), but it is constrained: the attacker must control or monitor an endpoint an administrator has deliberately connected to, and a victim user must route a request through that connection. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV); a vendor-released patch exists in 0.11.4.
Path traversal in IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1 and 9.2 lets remote, unauthenticated attackers read arbitrary files from the server by sending crafted URL requests containing '../' sequences. The flaw carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), so impact is confined to confidentiality with no data modification or denial of service, and the independent assessment rates the overall signal as moderate and internally consistent rather than alarming. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV; practical exposure depends mainly on internet reachability and on the OS-level file permissions of the account running the Maximo web process, since only files that account can read are disclosed.
Path traversal in the Hex package manager for the Elixir/Erlang (Mix) ecosystem, versions 0.6.0 through 2.5.1, lets a malicious package publisher delete a directory outside the project's deps/ folder and write the package's files into that location when a developer runs mix deps.get or mix deps.update. The attacker abuses a dependency's OTP application label, which Hex copies from the signed registry without validation and Mix joins onto deps/ as the checkout path, so a crafted label such as '../../target' escapes the project tree through File.rm_rf!/1 before any dependency code is compiled. Exploitation requires the victim project to depend directly or transitively on the attacker-controlled release and the developer to explicitly fetch dependencies, so no victim-side authentication is needed (PR:N) but user interaction is required; no public exploit identified at time of analysis, and the vendor rates it CVSS 7.5.
Progress MarkLogic Server deployments on Microsoft Azure running 12.x releases before 12.1.0 or 11.x releases before 11.3.7 can write security-sensitive authentication information into diagnostic logs under a specific, non-default configuration, allowing anyone with read access to those logs to harvest credentials or secrets and use them to reach protected cloud resources. The exposure is confidentiality-only: the vulnerability itself provides no code execution, integrity, or availability impact, and it is limited to Azure-hosted deployments - on-premises and other non-Azure installations appear out of scope. Exploitation requires an attacker to already have access to the diagnostic logs (through log storage, a log aggregation pipeline, or insider/lateral access) and requires the triggering configuration to be present; no public exploit code and no confirmed active exploitation were identified at time of analysis. Note that the vendor-published CVSS 3.1 vector (AV:N/AC:L/PR:N, 7.5) describes a remote unauthenticated attack, which conflicts with the description, CWE-532, and our assessed vector (AV:L/AC:H/PR:L, confidentiality-only), so the practical attack path should be treated as a log-access-dependent secret disclosure rather than an unauthenticated remote breach.
A path traversal flaw in rebar3, the standard build and dependency-management tool for Erlang/OTP, lets a malicious Hex package publisher cause rebar3 to delete an arbitrary directory and write package files into it whenever a developer or CI job fetches that package's dependencies. The attack abuses an unvalidated 'app' field in Hex registry dependency metadata: rebar3 treats that field as the dependency directory name, so a value such as '../../../../target' resolves outside the project's _build tree and is then removed with rm -rf before the fetched package is moved into place. Only rebar3 3.7.0-rc1 through 3.27.1 is affected, exploitation requires user interaction (a developer running rebar3 get-deps against a project that pulls in the malicious release, directly or transitively), and because the deletion occurs before the dependency's rebar.config.script is evaluated and get-deps compiles nothing, the practical impact is destructive file deletion and overwrite rather than immediate code execution; no public exploit code has been identified at time of analysis, and the public hex.pm registry added validation for the field on 2026-10-12, leaving private or self-hosted Hex registries as the main residual exposure.
Arbitrary file write via path traversal in IBM Planning Analytics 2.0 and 2.1 allows remote unauthenticated attackers to write files to arbitrary locations on the server by submitting a crafted URL containing '/../' sequences. The vulnerability carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating high integrity impact but no confidentiality or availability impact. A vendor patch is available per IBM support node 7291604, and no public exploit identified at time of analysis.
Unauthenticated remote attackers can exploit deprecated OpsDirector functionality in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 to perform server-side request forgery (SSRF), making unauthorized requests to internal services or forging trusted requests that may expose protected information. Exploitation is conditional on the OpsDirector component being present and network-reachable; no public exploit code has been identified at time of analysis. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability impact.
XML external entity (XXE) processing in Progress MarkLogic Server 11.x before 11.3.7 allows remote, unauthenticated attackers to disclose local files or trigger outbound network requests from the server through attacker-supplied SAML messages. Exploitation is conditional: the instance must be configured to use SAML single sign-on, since only the SAML parser's handling of external DTDs and entities is affected, and the impact is limited to confidentiality (C:H, no integrity or availability impact, CVSS 7.5). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so this represents a genuine but conditional priority - patching matters most for deployments that have SAML SSO enabled and exposed to untrusted networks.
Remote unauthenticated attackers can cause a denial of service in IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 by exhausting resources through uncontrolled resource consumption (CWE-400). The flaw is network-reachable with low complexity, requires no privileges or user interaction, and results in high availability impact, yielding a CVSS 3.1 base score of 7.5. No public exploit code has been identified at time of analysis, and IBM has released a patch.
MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 fail to consistently write successful authentication events to the audit log, which degrades a customer's ability to detect and investigate unauthorized access or credential misuse. The exposure is limited to logging/visibility: independent assessment rates the impact as integrity-only against the audit record (C:N/I:L/A:N), and the flaw gives an attacker no access by itself - harm only materialises after a separate successful authentication with legitimate or stolen credentials. There is no public exploit identified at time of analysis, and remediation is an upgrade to 12.1.0 or 11.3.7 or later.
Unauthenticated network requests to IBM Maximo AI Service 9.1.0 and 9.2.0 can exhaust server resources and render the service unavailable, as described by CWE-400 uncontrolled resource consumption. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5), the flaw is network-reachable, low-complexity, and requires no credentials or user interaction, but its impact is confined to availability - there is no data disclosure, data modification, or code execution. IBM has published a vendor patch advisory (https://www.ibm.com/support/pages/node/7290473); no public exploit code and no confirmed active exploitation were identified at time of analysis, so the realistic risk is service downtime for internet- or network-exposed deployments rather than a breach.
Denial of service in IBM Maximo AI Service 9.1.0 and 9.2.0 SaaS allows remote unauthenticated attackers to trigger uncontrolled recursion in an exposed processing path, causing availability impact. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so no privileges or user interaction are required and only availability is affected; no public exploit identified at time of analysis. IBM has released a vendor patch via its support advisory for the identified service levels, and because the product is SaaS, IBM controls the deployed instance and its patching.
Denial of service in IBM Maximo AI Service 9.1.0 and 9.2.0 allows unauthenticated remote attackers to terminate the host process by sending malformed frames that the service does not handle correctly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms that no credentials or user interaction are required, so the only practical gating factor is network reachability to the service endpoint; impact is confined to availability with no data disclosure or modification. No public exploit code has been identified at time of analysis, and the vendor has published a patch advisory.
Denial of service in the IBM Maximo Application Suite IoT Component (versions 9.0.0, 9.1.0, and 9.2.0) allows a remote, unauthenticated attacker to exhaust or crash the service by triggering uncontrolled recursion in its input parsing/processing logic. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials or user interaction are required against a network-reachable instance, but the impact is strictly availability - there is no confidentiality or integrity effect. At the time of analysis there is no public exploit identified, and the vendor has released a fix via its support portal.
Denial of service in IBM Maximo AI Service 9.1.0 and 9.2.0 lets remote, unauthenticated attackers disrupt the service through improper input validation (CWE-20), with impact limited to availability and no confidentiality or integrity loss. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) indicates the flaw is network reachable, low complexity, and requires no privileges or user interaction, so any deployment exposing the AI Service interface beyond trusted internal networks is at risk. No public exploit code has been identified at time of analysis and the CVE is not listed as confirmed actively exploited (CISA KEV); the practical risk is driven by exposure scope rather than observed attack activity.