OS command injection in EG Secure Solutions' SiteGuard Server Edition allows an attacker who already holds a low-privilege account or foothold on the host to execute arbitrary OS commands as root (Apache httpd/nginx on Linux or FreeBSD) or SYSTEM (IIS on Windows), achieving full compromise of the affected server. The CVSS 4.0 base score of 8.5 reflects a local attack vector (AV:L) with low privileges (PR:L), no user interaction (UI:N), low complexity (AC:L), and high confidentiality, integrity, and availability impact confined to the vulnerable system (VC:H/VI:H/VA:H, SC:N/SI:N/SA:N) - it is not remotely exploitable by an anonymous external client. No public exploit code and no confirmed active exploitation were identified at time of analysis; JPCERT/CC reported the issue and EG Secure Solutions and JVN have published advisories.
Authenticated attackers holding high-privilege administrative access to the PAN-OS management interface can execute arbitrary code with root privileges on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). The underlying weakness is a code-injection flaw (CWE-94) in the management plane that is network-reachable with low attack complexity, but the realistic attacker population is narrow because CVSS PR:H requires the adversary to already possess an authenticated high-privilege session, and Palo Alto's recommended practice of limiting management access to trusted internal IP addresses largely neutralizes the exposure. Cloud NGFW and Prisma Access are explicitly not impacted, and no CISA KEV entry or public exploit code is identified in the available data at time of analysis.
Stored cross-site scripting in the WP Booking System WordPress plugin before 2.1.0.1 lets unauthenticated attackers plant a malicious payload through a public-facing booking form; the value is stored without sanitisation or escaping and is later rendered unescaped inside an administration screen, where it executes in the session of any administrator who views the record. Exploitation is gated by that administrator interaction - the payload is inert until an admin opens the affected admin view - and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, while our own assessment caps the realistic impact at low confidentiality and integrity within a changed scope (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rather than the 8.8 score reported by NVD. Publicly available exploit code exists and the plugin is widely deployed, but EPSS is only 0.22% (12th percentile) and there is no confirmed in-the-wild activity, so the practical risk hinges on whether an administrator can be induced to open the poisoned admin screen.
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to submit a crafted form value that the plugin neither sanitises on storage nor escapes when rendering the form submissions screen, so the injected script executes in the browser of any administrator who later opens that dashboard view. Exploitation depends on the site actually using the plugin's public-facing submission feature and on a privileged user subsequently viewing the submissions list, which makes execution deferred and not attacker-controlled in timing; public exploit code exists, but exploitation is not confirmed active (CISA SSVC: exploitation none) and EPSS is low at 0.21% (10th percentile). Our independent assessment re-scores the issue as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - a genuine but non-urgent risk rather than a widespread emergency.
Unauthenticated SQL injection in the Fast Courier WordPress plugin (versions 5.0.0 through 5.2.3) lets any remote attacker who can reach the plugin's unauthenticated REST route inject arbitrary SQL and read data from the underlying WordPress database. No credentials or user interaction are required (CVSS vector PR:N/UI:N), and the impact is confidentiality-only - data can be read but not modified, and availability is unaffected (I:N/A:N). Publicly available exploit code exists and the finding is documented in a WPScan advisory, though EPSS is only 0.21% (11th percentile) and there is no CISA KEV listing, so this is a genuine but non-emergency, scope-limited issue that chiefly matters to sites running this niche plugin below 5.2.4. Vendor patch: 5.2.4.
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execute SQL injection and forge payment webhooks, marking arbitrary WooCommerce orders as paid. The webhook signature check uses a signing secret that is empty by default, so any default installation is vulnerable; the SQL injection works without authentication or user interaction. Publicly available exploit code exists, but EPSS is low (0.21%, 11th percentile) and CISA SSVC indicates no observed exploitation; the vendor has released patch version 1.8.5.
Unauthenticated local file inclusion in the Ultimate Multisite WordPress plugin before 2.17.2 allows remote attackers to traverse the filesystem and read arbitrary local files, including wp-config.php with its database credentials and authentication salts. The plugin passes a user-supplied file-selection value directly into an include operation without validation, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms no authentication and no user interaction are required. Publicly available exploit code exists, but EPSS is low at 0.20% (10th percentile) and CISA SSVC records no known exploitation, so real-world risk is concentrated in internet-reachable WordPress sites that have the plugin active.
Local privilege escalation in MyReport Updater through 2.1.1 allows authenticated low-privileged local users to gain SYSTEM rights by abusing the updater service's gRPC interface (UpdaterManager.exe) to set a malicious reference server and arbitrary installLocation, then planting a DLL such as HID.dll that is loaded by osk.exe. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). With a CVSS 4.0 score of 8.5 and assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this is a genuine, actionable local privilege escalation rather than an inflated high-CVSS score, though it is not a mass-exploitation emergency.
TurboDocx html-to-docx through 1.23.1 is vulnerable to server-side request forgery (CWE-918): when an application converts attacker-supplied HTML to DOCX with remote image handling enabled, the library dereferences <img src> URLs server-side, and a loose isValidUrl() check allows loopback, RFC1918 private, and cloud metadata addresses (e.g. 169.254.169.254) to be requested and their responses embedded into the generated document's word/media folder. The flaw is remotely reachable without authentication or user interaction (CVSS:4.0 PR:N/UI:N, 8.2; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), and publicly available exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing) and no vendor-released patch identified at time of analysis. Real-world risk is conditional rather than universal: the attacker must supply a live, responsive internal target, the fetched response must be readable from the returned DOCX, and deployments that disable remote image fetching, filter outbound traffic, or restrict HTML input are not exploitable.
Use-after-free in curl's HTTP/2 client code (curl 8.12.0 through 8.22.0) can corrupt memory when a server answers an in-progress upload with an HTTP/2 RST_STREAM frame carrying the HTTP_1_1_REQUIRED or REFUSED_STREAM reason code, freeing the internal struct Curl_easy object while it is still referenced by the transfer state machine. The flaw is remote and requires no authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but exploitation is conditional: the victim must be uploading over a negotiated HTTP/2 connection to an endpoint the attacker controls or influences, and the RST_STREAM must land at the right point in the transfer lifecycle, which is why the assessed complexity is High. Publicly available exploit code exists (SSVC Exploitation: poc) and CISA's framework rates technical impact as total, yet there is no confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.23% (12th percentile); a vendor patch is available. The same flaw affects libcurl and therefore every downstream application and distribution shipping an affected build.
Remote code execution in the affiliate-toolkit WordPress plugin (versions before 3.9.1) lets an authenticated user holding the Contributor role or higher submit a template body that the plugin's bundled templating engine compiles and runs as PHP, giving full server-side code execution with high confidentiality, integrity, and availability impact. Any WordPress site running an affected version is exposed, and because Contributors are unprivileged content authors, sites with open author self-registration or large multi-author teams carry the greatest practical risk; no end-user interaction is required. Publicly available exploit code exists (documented via WPScan) and the EPSS score is low at roughly 0.18% (8th percentile), with no indication of confirmed active exploitation (CISA KEV) and no SSVC exploitation signal, so this rates as a moderate-but-real priority for sites that actually run the plugin.
Malicious SMB servers can crash libsmb2 clients through version 6.2 by returning a crafted SMB2 QUERY_INFO reply that triggers a heap out-of-bounds read during security descriptor decoding. The bug is an integer underflow in decode_acl: an ACL whose AclSize field is smaller than 8 bytes underflows the remaining-buffer counter, bypassing the per-ACE bounds check and producing an availability-only denial of service with no code execution, data disclosure, or integrity loss. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the attacker must either control the SMB server the victim connects to or hold a man-in-the-middle position on an unsigned SMB session (UI:P/UI:R), making this a moderate-priority availability issue rather than an emergency.
Heap out-of-bounds read in libsmb2 through 6.2 allows a malicious or man-in-the-middle SMB server to crash the client by returning crafted QUERY_INFO replies for FileFsVolumeInformation or FileFsAttributeInformation with missing or oversized name-length fields. Affected clients must issue a filesystem-information query against an attacker-controlled endpoint, or an attacker must hold a man-in-the-middle position on an unsigned SMB session, so exploitation is remote and unauthenticated but requires the victim to initiate the connection (user interaction). Publicly available exploit code exists, but there is no confirmed active exploitation and the impact is confined to a client crash, with no demonstrated confidentiality or integrity effect. The vendor has published an upstream fix.
A heap out-of-bounds read in libsmb2 through 6.2 lets a malicious SMB server (or a man-in-the-middle on an unsigned SMB session) crash a connecting client by returning a crafted FileAllInformation reply with an unchecked FileNameLength field. The bug is reached when the client library parses the server's reply inside smb2_decode_file_all_info, which is triggered by calls such as smb2_stat or smb2_fstat on the client side; publicly available exploit code exists, and a vendor fix is available upstream. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), impact is limited to client process availability - there is no code execution or data exposure, and unauthenticated remote attackers need the victim to initiate a connection to the attacker-controlled server.
Privilege escalation in the Ignition Perspective module (Inductive Automation Ignition) - a genuine high-priority issue in an OT/ICS context - allows an authenticated user with legitimate access to a Vision project to supply their valid Vision session identifier and obtain Designer-level privileges, leading to arbitrary code execution in the context of the Ignition Gateway process. The flaw (CWE-863, CVSS 8.7) affects Gateways where both Vision and Perspective modules are deployed, requires low-privilege Vision credentials and a valid session, and needs network reachability but no user interaction. No public exploit identified at time of analysis.
Unauthenticated OS command injection in the bootzd zero-touch provisioning (ZTP) daemon of Juniper Networks Junos OS Evolved on PTX Series routers allows an attacker positioned on the management LAN to execute arbitrary commands as root by sending a crafted gRPC response to a device that is actively provisioning. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting low attack complexity, no authentication or user interaction requirements, and full confidentiality, integrity, and availability impact; the adjacent-network attack vector (AV:A) means the device is not exploitable directly from the internet. No public exploit code has been identified at time of analysis, no CISA KEV listing or EPSS score was provided, and exposure is materially reduced where management traffic runs over a segmented or physically isolated out-of-band network and where devices are not in an active ZTP state.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, unauthenticated attacker who operates a rogue DHCP server execute arbitrary commands as root on affected EX Series, SRX Series, and QFX Series devices. Exploitation is not remotely routable: the attacker must share a Layer-2 broadcast domain with the target and the device must be actively running phone-home / zero-touch provisioning (ZTP), which is why an independent assessment rates the attack complexity higher than the vendor's 8.7 score despite the high confidentiality, integrity, and availability impact (PR:N/UI:N once those conditions hold). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry), though NVIDIA/ENISA EUVD tracking and a full Juniper advisory (JSA112187) with vendor patches indicate this is a genuinely high-priority, patchable issue.
OS command injection in Runnerty's @runnerty/executor-decompress package (all versions through 3.1.1) lets an attacker who can control the name of an archive file processed by a compress_file/decompress task execute arbitrary shell commands with the privileges of the Runnerty process. The package builds shell command strings from templates that interpolate the archive filename and then hands them to shelljs exec(), so a filename containing $() command substitution or unquoted shell metacharacters - for example one dropped into a watched or ingested directory - is interpreted by the shell instead of being treated as a literal path. Exploitation requires low-privileged access sufficient to name files in that directory (PR:L) and no user interaction; impact to confidentiality, integrity, and availability is high but is bounded to the Runnerty process's privilege level, and no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in the Koha integrated library system lets an authenticated staff account holding the tools => schedule_tasks permission execute arbitrary operating-system commands as the Koha web/application user. The flaw lives in the tools/scheduler.pl handler: an op=cud-delete request passes the unvalidated jobid parameter into C4::Scheduler::remove_at_job, which hands it to Schedule::At::remove, where the value is spliced into an atrm command string and run through a single-argument system() call that invokes the shell - so shell metacharacters in jobid become executable commands. Per the CVSS vector the attack is network-reachable with low privileges required (PR:L) and no user interaction (UI:N), scoring 8.8, but it is strictly post-authentication and gated by a deliberately granted staff capability; no public exploit code has been identified at time of analysis and there is no CISA KEV listing. Vendor fixes are available in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04.
Command injection in the NetBird desktop client (versions 0.60.0 through 0.74.6) lets a malicious or compromised peer inject arbitrary OpenSSH directives - including command-executing ones - into the system-wide drop-in config of other clients' Linux, macOS, Windows and FreeBSD hosts. Exploitation requires the attacker to control an enrolled peer whose crafted FQDN or hostname containing a double quote is distributed to the victim, and the injected command runs only when a local user subsequently invokes ssh, so peer membership plus a local user action are both prerequisites rather than an unauthenticated internet-facing attack. NetBird 0.74.7 fixes the issue by rejecting peer names that are not valid DNS names; no public exploit identified at time of analysis, and the Android and iOS apps are not affected.
Elevation of privilege in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privileged user perform actions reserved for higher-privileged accounts over the network, yielding high confidentiality, integrity, and availability impact across the affected server. The flaw is a missing authorization check (CWE-862) rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is not usable by fully unauthenticated outsiders: the attacker must already hold a valid low-privilege SharePoint account and the site must be network-reachable, with no user interaction or non-default configuration required. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so exploitation requires a motivated authenticated insider or an attacker who has already obtained low-privilege credentials; Microsoft has published a vendor patch, making this a straightforward fix-and-prioritize item for exposed SharePoint deployments.
Authenticated file upload bypass in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.54.7212) allows a subscriber-level user to write attacker-supplied content to the server by slipping a crafted filename past the plugin's incomplete check_mimetype extension filter, which performs no MIME inspection and skips the standard WordPress upload helpers, potentially resulting in remote code execution. Exploitation is not unconditional: the plugin's non-default 'profile videos on bio' setting must be enabled so that the required nonce is emitted on the subscriber-accessible profile page, and the attacker must craft a filename that evades the partial extension enforcement; sites that keep registration closed or leave that option disabled are substantially less exposed. The published CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the assessed vector applies AC:H to reflect the non-default configuration prerequisite; no public exploit code identified at time of analysis, and the issue was reported by Wordfence.
Authentication bypass in Progress MOVEit Transfer allows an attacker who already holds a low-privilege authenticated foothold to reach protected functionality by traversing an alternate path or channel that skips the intended authentication and authorization checks, yielding high confidentiality and integrity impact at CVSS 8.8. Only MOVEit Transfer releases prior to 2025.1.6 and 2026.0.0 builds before 2026.0.4 are affected, and because the assessed vector carries PR:L the attacker must already possess some credentialed access, which narrows the exposure compared with an anonymous pre-auth bypass. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor issued a Critical Security Bulletin for this issue, making prompt patching the priority.
Remote code execution in ONLYOFFICE Document Server affects every release before 10.0.0, allowing an attacker who holds a valid Inbox-compatible JWT to run arbitrary OS commands as the ds service account. The flaw lives in the Document Builder API: because the optional third argument of builder.SaveFile() accepts user-controlled converter XML, injecting a duplicate m_sFileTo element overrides the server-generated output path and lets the attacker write outside the designated job directory, overwrite runtime.json, and repoint the Document Builder executable so that commands execute during a subsequent job. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact, with exploitation gated on possession of a JWT signed with the deployment's secret (PR:L).
SQL injection in the Custom Reports module of Progress MOVEit Transfer allows an authenticated low-privilege user to inject arbitrary SQL into report queries, potentially exposing or altering data in the underlying database. Versions before 2025.1.6 and 2026.0.0 through 2026.0.3 are affected; exploitation requires a valid account with access to Custom Reports (CVSS PR:L), no user interaction, and low attack complexity. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is 0.49% (40th percentile), indicating limited observed exploitation likelihood despite the high CVSS 8.8 impact.
Authenticated SQL injection in WeGIA versions prior to 3.8.6 allows a user with access to the Material & Patrimônio module to inject arbitrary SQL through the id_produto parameter of web/html/matPat/restaurar_produto_desocultar.php, enabling extraction of sensitive database records and modification of institutional and inventory data. The flaw is rated CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires a valid low-privileged account plus module-level authorization, so anonymous visitors cannot trigger it. No public exploit identified at time of analysis; the vulnerable code path ships by default in affected releases and a vendor fix (3.8.6) is available.
Command injection in the Markdown Preview Enhanced VS Code extension (which bundles the crossnote library) on Windows allows an attacker-controlled Markdown link to execute arbitrary commands with the privileges of the VS Code user. When a victim opens an untrusted Markdown file, previews it, and clicks a crafted external or unsupported-scheme link, the decoded link target is passed to a Windows file-opening helper that invokes child_process.exec with the start command, so embedded cmd.exe metacharacters are interpreted as command separators. The flaw affects versions prior to 0.8.28 (crossnote prior to 0.9.29), requires user interaction (opening the file and one link click), needs no workspace trust, no script execution, and no additional files, and earns a CVSS 3.1 base score of 8.8; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Persistent telemetry dial-out denial of service in Juniper Networks Junos OS Evolved allows an attacker with management-plane access to the device's gNMI listener to crash or wedge the jti-dialoutd telemetry process by submitting a crafted analytics sensor resource that is consumed as a format string (CWE-134). Exploitation requires the gNMI listener to be reachable and enabled with telemetry/JTI dial-out configured, and Juniper's description characterizes the actor as authenticated; note that the published CVSS vector lists PR:N, which contradicts that authentication prerequisite and should be reconciled against Juniper advisory JSA112250. Impact is confined to loss of telemetry dial-out and analytics streaming rather than data-plane forwarding, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Missing authorization in the handleLocalTerminal WebSocket handler of Skyhook Radar before 1.12.2 lets an attacker who can reach the /api/local-terminal endpoint spawn an interactive /bin/bash -l shell on the Radar host with Radar's own kubeconfig and process credentials injected into the environment, achieving remote code execution with Radar's privileges. The handler is governed only by a runtime-mode check instead of role-based access control, and per the advisory the exploit still works when the operator has set --disable-local-terminal, so that flag cannot be relied on as a mitigation in vulnerable builds. The vendor's CVSS 4.0 rating is 8.7 (VC:H/VI:H/VA:H, PR:L) while our independent reassessment scores it CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning authentication is not reliably enforced despite the PR:L marking; there is no CISA KEV entry and no public exploit code identified at time of analysis, and real-world exposure is chiefly limited by the fact that Radar is a local-first developer tool that is normally bound to localhost on an individual workstation.
LDAP injection in Progress MOVEit Transfer lets an attacker with low-privilege authenticated access manipulate directory queries when the LDAP module is configured, potentially exposing or altering sensitive data. Affected releases are MOVEit Transfer before 2025.1.6 and 2026.0.0 before 2026.0.4; deployments that do not use LDAP-backed authentication or directory lookups are not on the vulnerable code path. No public exploit identified at time of analysis, EPSS is low at 0.41% (34th percentile), and CISA SSVC rates exploitation as none, making this serious but not an emergency for most defenders.
Improper Unicode canonicalization in Progress MOVEit Transfer before 2025.1.6 and in 2026.0.0 through 2026.0.4 allows an authenticated remote attacker to submit crafted encoded input that bypasses input validation, producing high confidentiality, integrity, and availability impact. The CVSS vector requires a low-privileged account (PR:L) with no user interaction (UI:N); EPSS is low at 0.40%, and no public exploit was identified at time of analysis. Vendor patches are available in 2025.1.6 and 2026.0.4.
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 expose a path traversal flaw in the GET /api/v1/pack endpoint that lets unauthenticated remote attackers read arbitrary files outside the configured --root directory, with the stolen content returned as a downloadable tar.gz archive. The root cause is a handler that calls the unguarded root() helper at server/rest/index.js:130 instead of the root.resolve() validation wrapper used on other endpoints, so percent-encoded traversal sequences in the pack path escape the intended document root and reach files such as /etc/passwd or SSH private keys. Impact is confidentiality-only (no write or code-execution primitive), and no public exploit identified at time of analysis, though a vendor patch (v19.21.2) and a public technical write-up are available; exploitation requires network reachability to the cloudcmd HTTP service, which many deployments gate behind localhost binding, a reverse proxy, or optional authentication.
Incorrect authentication-algorithm handling in Progress MOVEit Transfer's SFTP module allows a remote, authenticated low-privilege SFTP user to subvert the module's authentication logic, with assessed high confidentiality, integrity, and availability impact. Affected deployments are MOVEit Transfer before 2025.1.6 and 2026.0.0 through 2026.0.3; vendor-fixed builds are available. No public exploit was identified at time of analysis, and EPSS is low at 0.39% (32nd percentile).
Authentication bypass in PgBouncer 1.17.0 through 1.26.0 allows an authenticated attacker who knows a valid password for at least one user in auth_file to impersonate another user that authenticates via SCRAM, including PgBouncer admin users and backend superusers, by sending a second StartupMessage during the SCRAM exchange against a non-existent database. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and stems from improper authentication (CWE-287). No public exploit identified at time of analysis, and the flaw does not grant access to users not authenticating via SCRAM.
Incorrect authorization in the Client Certificates module of Progress MOVEit Transfer lets an attacker who already holds a valid low-privilege account escalate to full control of managed file-transfer data and configuration (CVSS 8.8, PR:L/AV:N). Affected builds are all releases before 2025.1.6 and 2026.0.0 through 2026.0.3, and the Client Certificates feature must be in active use for the flawed authorization path to be reachable. There is no public exploit code identified at time of analysis and EPSS sits at roughly 0.21% (11th percentile), so risk is real but not urgent; a vendor patch is available per the Progress September 2026 security bulletin.
Improper access control in the export settings feature of SonicWall Network Security Manager (NSM) on-prem let a remote authenticated attacker with only low-privilege NSM credentials retrieve sensitive information that should be restricted to higher-privileged users, which the vendor states could be used to escalate to administrator or to intercept other NSM users' communications. Affected deployments are NSM on-prem 4.3.1 and earlier; the hosted/SaaS NSM is not indicated as in scope, and exploitation requires a valid account plus access to the export settings functionality (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). There is no public exploit code identified at time of analysis, no confirmed active exploitation (SSVC Exploitation: none), and EPSS is low at 0.20% (10th percentile), so this is a genuine but not emergency-grade priority - its realistic impact presumes a multi-user NSM deployment in which other privileged accounts or traffic exist to leverage.
SQL injection in Redash (versions after 8.0.0 through 26.9.0) lets an authenticated user with view-only access to both the Query Results data source and a referenced data source inject arbitrary SQL that runs with the referenced data source's privileges. The flaw lives in redash/query_runner/query_results.py, where param_query_N_{key=value} parameters were substituted into the target query's SQL via replace_query_parameters() rather than through the ParameterizedQuery schema validator, and where the is_safe permission check was skipped; the vendor CVSS 4.0 base score is 8.7, and no public exploit code or CISA KEV entry was identified at time of analysis. Because exploitation requires valid credentials plus dual data-source access, this is realistically an insider or compromised-account risk, with the greatest exposure in deployments that grant low-privilege users view-only access to sensitive referenced data sources.
Privilege escalation in Red Hat OpenShift Container Platform 4's insights-runtime-extractor DaemonSet lets an authenticated low-privileged tenant who can schedule a pod on a node run attacker-controlled code as root in the host user namespace. The extractor scanner enters the workload's namespaces and executes the workload's argv[0] via exec.Command after only seteuid() has changed, leaving real/saved UID 0 and retaining capabilities; a malicious pod binary matching node, python, python3, MainThread, or any path containing java can call setuid(0) and reach the host CRI-O socket from the inherited cwd. CVSS 8.8 (AV:L/PR:L/S:C) reflects local, non-network exploitation requiring workload scheduling, and no public exploit was identified at time of analysis.
Progress MOVEit Transfer versions before 2025.1.6 and from 2026.0.0 before 2026.0.4 assign incorrect permissions to a critical resource, allowing an authenticated low-privileged user who already has local or session access to read and modify resources beyond their intended privilege boundary, yielding high confidentiality and integrity impact (CVSS 8.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The prerequisite of a valid low-privileged account plus local/session access - rather than anonymous remote reach - keeps this a conditional, post-authentication escalation issue; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. There is no EPSS score in the supplied data, so exploitation likelihood is judged from the assessed vector alone; because this is a file-transfer platform typically holding regulated data, the impact of success is high even though the entry bar is elevated.
A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend, or a guest able to drive IOTLB invalidations on the vhost device, a path to memory corruption inside the host vhost process. The flaw is that the VDUSE handler does not invalidate cached vring pointers when the IOTLB is invalidated, so the code keeps dereferencing vring addresses that have already been unmapped - a classic CWE-416 use-after-free. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) marks this as locally reachable, low-complexity and low-privilege, with a scope change (S:C) reflecting that a confined guest/userspace VDUSE device can compromise the host vhost trust boundary; impact is full confidentiality, integrity and availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE. Affected packages are Red Hat's Fast Datapath DPDK channel for RHEL 8, 9 and 10, with downstream exposure noted for RHEL, OpenShift Container Platform 4 and OpenStack Platform 13 Queens.
An authenticated format-string vulnerability in the gRPC daemon that backs the gNMI service on Juniper Networks Junos OS Evolved lets a network attacker who holds valid low-privileged credentials feed crafted format specifiers into a telemetry code path, with potential outcomes ranging from telemetry-service disruption and information disclosure up to root-level code execution. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is remote but requires an authenticated session against an enabled, network-reachable gNMI interface - it is not reachable by a fully anonymous attacker. At the time of analysis there is no CISA KEV entry and no public exploit code identified, and the vendor has published advisory JSA112250; this is a credible priority for organizations running Evolved with gNMI exposure, but not a drop-everything emergency on the available signals.
Remote code execution with root privileges or denial of service in Juniper Networks Junos OS on SRX Series devices is possible through a stack-based buffer overflow in the iked IKE key-management daemon. An authenticated remote-access VPN client on an SRX running affected Junos OS releases can exploit the remote-access VPN authentication and JIMS identity-publishing path; deployments not using remote-access VPN or JIMS identity publishing are not exposed. No public exploit code has been identified at time of analysis, but a vendor patch is available and the vendor CVSS score is 8.7 with high confidentiality, integrity, and availability impact.
Remote, unauthenticated attackers can crash the na-grpcd daemon on Juniper Networks Junos OS Evolved by sending a crafted gRPC telemetry subscription request, causing a denial of service. This affects devices where the gRPC telemetry subscription service is enabled and reachable; no public exploit code is known, and the process restarts automatically, limiting outage duration. The CVSS 4.0 score is 8.7 (High), while the independent assessment rates availability impact as High (CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Denial of service in Juniper Networks Junos OS and Junos OS Evolved arises when the routing protocol daemon (rpd) dereferences a NULL pointer while processing multiple BGP UPDATE messages delivered over a single TCP session, but only with the non-default 'bgp family l2vpn auto-discovery-only' BGP family configured. A remote BGP peer can crash rpd and interrupt routing services on the affected device; the daemon recovers, and there is no confidentiality or integrity impact. Exploitation requires an already-established, configured BGP adjacency rather than arbitrary internet access, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker who already holds an established EVPN BGP peering relationship with a target device to disrupt the routing protocol daemon (rpd) by sending EVPN BGP routes that trigger an integer overflow or wraparound. The flaw affects EVPN-enabled routing instances and can tear down control-plane adjacencies and halt route processing, producing an availability-only impact with no confidentiality or integrity effect. EVPN is a deliberately configured, non-default feature and the peering trust relationship must pre-exist, so realistic exploitation is limited to EVPN deployments and adjacent or compromised BGP peers; no public exploit code was identified at time of analysis, and the vendor advisory is Juniper JSA112187.
A malformed or misdirected BGP route update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking down the control plane that maintains routing state across the device. The trigger is narrow but fully remote: a Long-Lived Graceful Restart (LLGR) stale route that is readvertised into a peer group that has not negotiated LLGR causes rpd to hit an improper-initialization condition (CWE-665) and abort. Per the CVSS vector the issue is unauthenticated (PR:N) on the network (AV:N) with high availability impact only, but the attacker must control or be an established BGP peer able to inject the stale route, so an existing adjacency is a practical prerequisite. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Juniper has released fixed software per advisory JSA112187, making this a patch-now availability risk for BGP-running fleets rather than an emergency.
Unauthenticated remote attackers can disable every installed plugin on JTL-Shop installations - including payment and shipping integrations - by toggling the plugin safe mode through the administration backend's logout route, which is processed before the request's authentication state is checked (CWE-306). The attack needs a single request, no credentials and no user interaction, and can be automated across many installations to produce a shop-wide denial of service; CVSS v4.0 rates it 8.7 with availability-only impact, and no public exploit code or CISA KEV listing was identified at time of analysis. Because the flaw lives in middleware ordering, exploitation works against default configurations wherever the admin backend is network-reachable, and impact is confined to availability - no data disclosure or code execution.
Uncontrolled HTTP/2 flow-control resource consumption in mtrudel/bandit 1.4.0 and later lets an unauthenticated remote peer hold server-side stream processes - together with their Plug conn state and any resource held mid-response - alive indefinitely by dripping small WINDOW_UPDATE frames just before each 15-second send deadline expires. Because both the connection-level (finish_data/5 re-queues the pending send with a fresh expires_at) and stream-level (send_data/3 recurses and re-arms read_timeout) deadline resets fire on partial progress, and the two paths are independent, an attacker can repeat the trickle across many streams and connections to exhaust processes and memory in a denial of service reachable with no authentication and no user interaction (CVSS 4.0 base 8.7; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis; an upstream fix commit is available and the issue is limited to bandit 1.4.0 and later.
Missing authorization in Swetrix's ProjectController.addProject allows any authenticated user - including a self-registered low-privilege account - to hijack an arbitrary project by moving it into an organisation they control, simply by submitting the victim's public tracking ID. Once ownership is transferred, the attacker can read the project's analytics, change its settings, or delete it, with no victim interaction required; the only prerequisites are an account on the same Swetrix instance and knowledge of the target's tracking ID, which is intentionally exposed in client-side tracking snippets. Exploitation is limited to individually targeted projects (one tracking ID per hijack) with no cross-system scope change, and no public exploit code has been identified at time of analysis, though the flaw is a genuine, actionable broken-access-control issue (CVSS 8.7 4.0 / 8.8 3.1, CWE-862) fixed in Swetrix 5.1.0.
Guest-to-host out-of-bounds access in DPDK's vhost-crypto backend lets a low-privileged guest VM that is already attached to a vhost-crypto device corrupt host-side memory by racing the host's two reads of an indirect-descriptor next index, a classic TOCTOU double-fetch (CWE-367). Only hosts running DPDK with lib/vhost's vhost-crypto library enabled and actually processing indirect descriptors are exposed, and the race makes reliable exploitation non-trivial - the assessed vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting host-local reach via the guest with cross-boundary (guest-to-host) scope change. Red Hat tracks this for Fast Datapath packages on Red Hat Enterprise Linux 8, 9 and 10; no public exploit code has been identified at time of analysis and there is no CISA KEV entry. Realistic exposure is limited to multi-tenant, untrusted-guest or confidential-computing style deployments where the vhost-crypto feature is deliberately enabled.