An adjacent eBGP peer can crash the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted VPLS signaling update, but only on routers where VPLS automatic site-ID negotiation is enabled and an external BGP peering session is already established. The flaw is a reachable assertion (CWE-617) in rpd that terminates the process, producing a denial of service with no confidentiality or integrity impact; Juniper rates it 7.1 under CVSS 4.0, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, treating it as a moderate-priority availability issue rather than an emergency. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so risk is concentrated in networks that combine external BGP peering with non-default VPLS auto site-ID negotiation.
Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG with ICCP can be disrupted by an adjacent, unauthenticated attacker who sends an inconsistent ICCP peer message that triggers a reachable assertion in the l2ald daemon. Successful exploitation results in a denial of service affecting availability, with no confidentiality or integrity impact; no public exploit was identified at time of analysis, and the attack is limited to environments that have the non-default MC-LAG/ICCP redundancy feature enabled and where the attacker can reach the ICCP peer relationship at Layer 2.
An unauthenticated attacker with an adjacent network position can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices by sending a specifically crafted RSVP packet, producing a denial of service on affected routing platforms. The flaw is a reachable assertion (CWE-617) that only triggers when RSVP signaling is enabled - i.e., devices running MPLS RSVP-TE within rpd - so unconfigured devices are not on the vulnerable path, and no data confidentiality or integrity impact is involved. As of analysis, there is no CISA KEV listing and no public exploit identified at time of analysis; vendor patches are available, and the real-world risk is tempered by the adjacency and RSVP-configuration prerequisites, making this a moderate rather than top-priority issue.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241, and QFX5250 switches configured for BGP global-load-balancing with more than 128 ECMP next-hops allows unauthenticated adjacent-network attackers to crash rpd, causing a denial of service. This moderate-severity (CVSS 6.5) flaw is availability-only; exploitation requires the specific hardware and non-default routing configuration, and no public exploit code has been identified at time of analysis. Devices not configured for BGP global-load-balancing or with 128 or fewer ECMP next-hops are not affected.
Unauthenticated adjacent IS-IS peers can cause a denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series by sending crafted input that fails proper quantity validation (CWE-1284). This medium-severity flaw (CVSS 6.5, AV:A/PR:N/UI:N/A:H) requires the attacker to hold Layer 2 adjacency on a directly connected or shared broadcast segment; no authentication or user interaction is needed. No public exploit code has been identified at time of analysis.
Memory exhaustion in the Juniper Networks Junos OS and Junos OS Evolved l2cpd process allows an unauthenticated attacker on the same Layer 2 segment to disrupt Layer 2 control-plane operations by sending LLDP traffic, but only when the non-default LLDP fast-receive-processing feature is enabled. No authentication or user interaction is required, and the impact is limited to availability (CVSS 3.1 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity effect. A vendor patch is available through Juniper advisory JSA112187, and no public exploit code has been identified at time of analysis.
Denial of service in Juniper Networks Junos OS allows an attacker on an adjacent Layer 2 network segment to exhaust resources in the l2cpd (Layer 2 Control Protocol) process, causing the daemon to restart and disrupting Layer 2 control-plane services on the affected device. The attack is unauthenticated and requires no user interaction, but is only reachable when the FNP feature is enabled on a VPLS routing instance that also has VLAN-VPLS encapsulation configured - a specific, non-default deployment that limits exposure; remote internet-based exploitation is not possible. All Junos OS platforms are potentially affected except the PTX Series and SRX Series, and no public exploit code or confirmed active exploitation was identified at time of analysis (the issue is not listed in CISA KEV), though a vendor patch is available.
An out-of-bounds read in the cfmd process of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated attacker on the adjacent network crash the daemon and disclose limited process memory by sending a crafted Connectivity Fault Management (CFM) message to an interface with CFM configured. Affected releases span Junos OS 23.x through 26.2 and corresponding Junos OS Evolved branches, with fixes available per Juniper advisory JSA112187. Exploitation is bounded by the non-default requirement that CFM be configured on a reachable Layer 2 interface; no public exploit identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-adjacent attacker to trip a reachable assertion in the bfdd daemon and restart it by sending crafted Bidirectional Forwarding Detection (BFD) session traffic. Only devices running an affected release train with BFD configured on at least one session are exposed, and the impact is confined to availability: repeated daemon restarts can disrupt BFD-based link-failure detection and slow routing convergence, but there is no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and the requirement that the attacker be on the same L2 segment or directly connected link (PR:N, AV:A) sharply limits the attacker population, making this a genuine but constrained availability risk rather than a top-tier emergency.
A namespaced authenticated attacker holding access to a Kubernetes service account can impersonate the NGINX Agent gRPC connection in NGINX Gateway Fabric and read TLS private keys belonging to Gateway deployments in other namespaces. Exploitation requires the Gateway Custom Resource Definition to be configured and an authenticated gRPC link between the control plane and NGINX Agent, making this an access-gated control-plane disclosure flaw with no data plane exposure. No public exploit code was identified at the time of analysis.
Denial of service in Nodemailer versions 3.0.0 up to but not including 10.0.10 allows an attacker who can influence message content - specifically the recipient list (to/cc/bcc) or header fields passed to the message builder - to force quadratic header unfolding in MessageParser.parseHeaders, exhausting CPU and blocking the Node.js event loop while DKIM signing is performed. Only low-privileged access to the send functionality is required (CVSS PR:L), and impact is limited to availability: no data exposure, integrity loss, or code execution is involved. There is no public exploit identified at time of analysis, and exploitation additionally depends on DKIM signing being active in the same process, which makes real-world risk highest for multi-tenant mail-sending services that accept user-controlled recipients or headers.
Denial of service in FreeRDP 3.0.0 through 3.31.x allows a malicious RDP gateway to pin a client thread at full CPU indefinitely via an infinite loop in http_response_recv(). An attacker who controls the gateway endpoint the client connects to can return an HTTP response with a nonzero Content-Length and an unrecognized, semicolon-containing Content-Type header, causing the client to consume CPU without progress. Exploitation is unauthenticated but requires the victim to initiate a gateway-mode connection (user interaction); no public exploit code has been identified at time of analysis, and the issue is a moderate-severity availability concern with no impact on confidentiality or integrity.
Null pointer dereference in FreeRDP versions 2.0.0 through 3.31.x allows a malicious RDP server to crash Linux clients that have serial-port redirection enabled. The attacker sends IRP_MJ_READ or IRP_MJ_WRITE requests either before the serial channel is created or after it is closed, causing CommReadFile or CommWriteFile to dereference a null handle and terminate the client. This is an availability-only issue (CVSS 4.0 score 7.1, no confidentiality or integrity impact) that requires the victim to initiate a connection to the attacker-controlled server and have serial redirection active; no public exploit code has been identified at time of analysis.
Null pointer dereference in the FreeRDP client's rdpsnd (audio redirection) channel allows a malicious or compromised RDP server to crash any connecting client running FreeRDP 3.0.0 through 3.31.x, producing a denial of service that terminates the user's RDP session. The trigger is a malformed rdpsnd fragment that sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST and arrives on a fresh channel; the CVSS vectors (4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VA:H, and the assessed 3.1 equivalent AV:N/AC:L/PR:N/UI:R/A:H) confirm unauthenticated remote reach but strictly availability-only impact - no confidentiality, integrity, or code-execution effect. Exploitation requires the victim to initiate a session against the attacker's server and to have audio redirection negotiated; there is no evidence of in-the-wild exploitation and no public exploit identified at time of analysis.
Crafted RSVP packets can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on devices where non-default Layer 2 label-switched path (L2 LSP) RSVP signaling is enabled. The issue is an adjacent-network, unauthenticated attack (CVSS v4.0 7.1, AV:A/AC:L/PR:N/UI:N, availability-only impact, and our independent assessment concurs with CVSS:3.1 AV:A/AC:L/PR:N/UI:N/A:H): the attacker must sit on the same Layer 2 segment as the target but needs no credentials and no user interaction, and a single malformed packet is sufficient. No public exploit code exists and there is no confirmed active exploitation at time of analysis, and the practical exposure is bounded because L2 LSP support is a non-default configuration; Juniper advisory JSA112187 provides patched releases.
Authorization bypass in FileRise prior to 3.18.0 allows an authenticated, low-privileged user to read - and, when they also hold edit-own permission, modify - files they do not own by exploiting a collision in folder metadata filenames. FileRise flattens logical folder paths into metadata filenames by replacing '/', '\\' and spaces with hyphens, so distinct folders such as team/docs and team-docs resolve to the same <name>_metadata.json file; an attacker who controls one colliding folder and knows the target basename can overwrite the uploader-ownership metadata that read_own and ownership-restricted edit checks rely on, making a victim file appear attacker-owned. The issue is rated CVSS 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) and is fixed in 3.18.0; exploitation requires a multi-user deployment, a crafted colliding folder name, pre-existing read_own access to the target folder and knowledge of the exact victim basename, and no public exploit identified at time of analysis. Single-tenant or single-user installations are effectively unaffected because no second user exists to victimize.
Reflected cross-site scripting (XSS) in the SimplyRETS Real Estate IDX WordPress plugin (versions up to and including 3.2.9) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session when they click a crafted link. The vulnerability requires user interaction (UI:R) and is non-persistent; no public exploit code or active exploitation has been identified at time of analysis. The specific vulnerable parameter is not named in the advisory, but the issue is a CWE-79 improper neutralization flaw.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to crash the routing protocol daemon (rpd) on an affected device that is deployed in a BGP traffic-engineering scenario, simply by delivering a single valid, optional, non-transitive BGP update over an already-established BGP session. The crash triggers an automatic rpd restart, so the impact is a temporary loss of routing and forwarding until the control plane reconverges rather than persistent compromise, and exploitation is practical only for an adjacent BGP peer or an attacker able to inject into an existing session - arbitrary internet-based exploitation is not possible. Affected releases include all Junos OS versions before 23.2R2-S6 as well as the 23.4, 24.2, 24.4 and 25.2 branches, plus the corresponding Junos OS Evolved releases; vendor patches are available via JSA112168, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis.
DOM-based cross-site scripting in the Crocoblock JetEngine plugin for WordPress (all versions through 3.8.16) lets remote attackers inject script that executes in a victim's browser when the victim interacts with attacker-controlled input processed by the plugin's client-side JavaScript. The vulnerability is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and carries a mandatory user-interaction requirement, so impact is confined to the browser session of a user who loads or clicks a crafted page or link rather than to the server itself. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); this is a moderate-priority issue rather than an emergency, though the plugin's broad install base on WordPress sites makes prompt patching advisable.
Adjacent attackers can crash the Juniper Networks Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted LDP packet into an already-established LDP session, causing a denial of service on the affected router. Only devices running MPLS with LDP enabled and an active LDP peering session are exposed, and the attacker must already hold a position on the adjacent network capable of injecting packets into that session (CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact; vendor CVSS 4.0 base 7.1). There is no confidentiality or integrity impact - the outcome is loss of rpd availability, though repeated crashes can degrade routing stability; no public exploit has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Denial of service in Juniper Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to crash the routing protocol daemon (rpd) by sending specifically malformed LSP-ping packets; this is a moderate-priority availability vulnerability, not a critical compromise, because it requires an adjacent-network position and MPLS LSP-ping processing to be enabled. No public exploit has been identified at time of analysis, and Juniper has released fixed software versions for both Junos OS and Junos OS Evolved. Successful exploitation causes only availability impact to rpd, with no data exposure or modification.
Unauthenticated adjacent attackers can crash the routing protocol daemon (rpd) on Juniper MX Series devices running Junos OS and ACX Series devices running Junos OS Evolved by sending a malformed IGMPv3 membership report over a directly connected network, producing a denial of service. The defect is a NULL pointer dereference (CWE-476) reached while the device processes IGMPv3 membership traffic, so exploitation requires multicast/IGMP to be configured and active on the receiving interface, and it does not yield any confidentiality or integrity impact. Vendor-reported CVSS 4.0 base score is 7.1 (AV:A, PR:N, UI:N, VA:H), and there is no public exploit identified at time of analysis; a vendor patch is available per Juniper advisory JSA112187 (EUVD-2026-101386).
Malformed OSPF packets crafted by an adjacent OSPF peer can crash the Juniper Networks Junos OS rpd routing daemon or disclose portions of its process memory, affecting both Junos OS and Junos OS Evolved builds below the fixed releases enumerated in JSA112187 (for example Junos OS prior to 23.2R2-S7.7, 24.2R2-S5.5 and 25.2R2-S2, and the corresponding -EVO builds). The weakness is an unauthenticated adjacent attack (CVSS v4.0 base 7.1, AV:A/PR:N/UI:N with high availability and low confidentiality impact), meaning the attacker must already hold or establish OSPF adjacency on the same routing segment, so exposure is confined to devices actively running OSPF rather than the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are already available, making this a moderate-priority routing-infrastructure issue rather than a mass-exploitation emergency.
Cross-tenant knowledge-base file read in Nexent through 2.7.0 allows any authenticated tenant to access other tenants' source documents by exploiting a missing tenant check in the check_file_access function for knowledge_base/ paths. Attackers in multi-tenant deployments can list objects via GET /file/storage to obtain presigned URLs or directly download files via GET /file/download/{object_name}. This is an authenticated information disclosure flaw requiring a valid account; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in GitPython before 3.2.0 lets attackers leak environment-variable secrets through crafted submodule names in a repository's .gitmodules file. The flaw occurs when Repo._clone() calls Git.polish_url() without expand_vars=False, so variable syntax in a submodule name is expanded during clone plus submodule_update and the resulting values surface in .git/modules directory names and DEBUG logs. Exploitation is unauthenticated per the CVSS vector (PR:N) but requires the victim to clone an attacker-supplied repository and invoke submodule handling, and leakage only materializes if sensitive values are present in the process environment; no public exploit code, CISA KEV entry, or EPSS score was identified in the provided data, and integrity and availability are unaffected (CVSS 4.0 base 7.1, moderate severity).
Authorization bypass in n8n versions before 1.123.83 allows an authenticated member account to spoof workflow identity by supplying a trusted workflow identifier in the Execute Sub-workflow node's inline JSON mode, enabling credential resolution from projects the attacker does not belong to and unauthorized modification of another workflow's static data and error-workflow dispatch. The vulnerability (CWE-639, authorization bypass through user-controlled key) requires valid low-privilege credentials plus knowledge of a foreign workflow identifier, so single-tenant, single-project, or non-inline-JSON deployments are materially less exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this as a moderate, authenticated-access issue rather than a mass-exploitation emergency.
Memory corruption in FreeRDP's grayscale JPEG clipboard conversion can crash the RDP client when a malicious server delivers a crafted clipboard item that the victim pastes as CF_DIB bitmap data. The flaw is a heap-based out-of-bounds write in winpr_convert_from_jpeg, affecting versions 3.3.0 up to but not including 3.32.0 that are built with the non-default WINPR_UTILS_IMAGE_JPEG=ON option. Exploitation requires the victim to connect to an attacker-controlled RDP server with clipboard redirection active and to actively paste the malicious grayscale JPEG; no public exploit code has been identified at time of analysis, and the impact is primarily availability-focused (crash) with limited integrity impact.
Credential theft in Heym 0.0.55 through 0.0.120 allows a shared collaborator to seize the error_workflow_id execution field and repoint it at an attacker-controlled workflow containing an HTTP node, so that when the owner's parent workflow enters an error state the owner's decrypted credentials are injected into the attacker's workflow and exfiltrated over the network. The attack is remote and low-complexity, requiring only low privileges - an existing collaboration grant on the target workflow (PR:L per both the supplied CVSS 4.0 vector and the assessed CVSS 3.1 vector) - with no user interaction, producing high confidentiality impact and only low integrity impact from the single overwritten field. No public exploit code or CISA KEV entry was identified at time of analysis, and single-owner Heym deployments that do not use shared collaborators are not exposed.
Reflected cross-site scripting in the Crocoblock JetProductTables WordPress plugin (all versions through 1.2.4) allows an unauthenticated attacker to execute arbitrary script in a victim's browser by luring them to a crafted URL, which can lead to session theft or privileged actions such as content injection if an administrator clicks the link. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so exploitation depends on user interaction (UI:R) and the payload is not persisted; the advisory reports a base score of 7.1 while our independent impact assessment keeps confidentiality and integrity low with no availability impact. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, making this a social-engineering-dependent risk that matters most on sites where privileged users are likely to click untrusted links.
Reflected cross-site scripting in the Brainstorm Force SureCart WordPress e-commerce plugin (all versions through 4.9.3) allows an unauthenticated attacker to run arbitrary JavaScript in the browser of a logged-in SureCart/WordPress user - typically a store administrator or operator - by delivering a crafted URL containing the payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the flaw is purely reflected there is no persistence: every victim must be individually lured into clicking the malicious link while authenticated, and no public exploit code for this CVE has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV). Independent assessment rates this a moderate-risk, not top-priority, issue, with the mandatory user interaction (UI:R) being the main factor limiting realistic exploitation compared with a no-interaction bug.
Reflected cross-site scripting (CWE-79) in the VideoWhisper 'Paid Videochat Turnkey Site' WordPress plugin (ppv-live-webcams) affects all versions through 7.5.12 and lets an unauthenticated attacker inject script into a reflected parameter that executes in the browser of a victim who clicks a crafted link. The attack is not self-triggering: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows no attacker authentication is needed but a victim must be socially engineered into following the malicious URL while logged in to a site running the plugin, and impact scales with the victim's privileges (an administrator click enables higher-value session abuse). No public exploit code and no confirmed active exploitation have been identified at time of analysis, and no EPSS score was provided; the Patchstack advisory remains the single reference.
Stored cross-site scripting in WPManageNinja's Best Payments Plugin for WP (WordPress plugin slug wp-payment-form) through version 4.6.27 lets attackers inject script that the plugin persists and later executes in a victim's browser, typically a logged-in administrator viewing the stored content in the WordPress dashboard, as required by the UI:R metric. The vulnerability is a CWE-79 improper-neutralization flaw rated 7.1 by the Patchstack reporter; our assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting low confidentiality and integrity impact within a changed browser scope and no availability impact, with PR:N implying the initial injection does not require credentials though the advisory should be confirmed as to whether the vulnerable sink is a public-facing submission form or an authenticated plugin area. There is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so real-world risk depends on the plugin's payment or submission feature being in use and an administrator visiting the poisoned page.
Reflected cross-site scripting (moderate severity, reported CVSS 7.1) in the Hippoo Mobile App for WooCommerce plugin (versions through 1.12.0) allows remote attackers to inject malicious scripts that execute in the browser of a user who clicks a crafted link. Exploitation requires a victim with an active session on the affected WordPress/WooCommerce site - typically a logged-in administrator - to interact with the link (UI:R), but no attacker authentication is needed (PR:N). As of this analysis, no public exploit code has been identified and the vulnerability is not known to be actively exploited.
Renovate before 44.60.1 permits authenticated repository users with configuration influence to circumvent the allowedHeaders restriction by embedding hostRules[].headers inside shared presets, causing custom HTTP headers to be injected into outbound requests Renovate makes to other hosts. This is an allowlist/authorization bypass requiring low privileges (PR:L per CVSS) and specific, condition-dependent prerequisites (AC:H), making it an insider or supply-chain-style abuse rather than anonymous remote exploitation. It is not confirmed as actively exploited (no CISA KEV entry) and no public exploit code has been identified at time of analysis.
OSPF-triggered denial of service in Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated adjacent OSPF peer crash the routing protocol daemon (rpd) when OSPF Source Packet Routing best-route Prefix-SID installation is configured, causing a reachable assertion (CWE-617) and loss of routing availability. Exploitation is genuinely conditional rather than broad-impact: the target must run the non-default SPRING/segment-routing Prefix-SID configuration, and the attacker must source OSPF traffic from within the routing domain on an adjacency rather than from across the internet, so routers without that feature enabled are not affected. No public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis, and Juniper has released fixed maintenance releases.
Incorrect authorization (CWE-863) in VentureDrake Laravel CRM before 2.4.0 allows an authenticated account that already holds user-management privileges to assign roles it is not entitled to hand out - including the 'Owner' role or a role belonging to another team - by tampering with the 'role' parameter accepted by Role::find() in UserController::store/update, and to remove cross-team users through the unscoped UserIndex Livewire delete() method. The result is privilege escalation to Owner-level control plus cross-tenant user deletion on affected installations; the CVSS v3.1 assessment is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H (high integrity and availability impact, no confidentiality impact). The issue is fully remediated in version 2.4.0 through an AssignableRole validation rule and an explicit Owner-role guard, and no public exploit was identified at time of analysis - reachability is gated by the need for a privileged administrative account (PR:H), so risk is real but not a mass-exploitation emergency.
A signature bypass in n8n's waiting-webhook endpoint allows attackers who possess a valid resume token for an existing Send-and-Wait execution to approve waiting executions intended for other users, causing downstream workflow actions to run under the workflow owner's credentials, which may include command execution if the workflow is configured to perform such actions. Affects n8n versions before 2.41.4 and 2.42.x before 2.42.1. No public exploit identified at time of analysis; exploitation requires a valid resume token (no authentication to n8n itself is needed beyond the token), and the impact is bounded by the target workflow's downstream nodes. This is a moderate-to-high priority issue for organizations running n8n, but not a drop-everything emergency.
The SeaweedFS Helm chart between versions 4.0.388 and 4.41 embedded a single, unencrypted Ed25519 SFTP host private key in the chart template k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml, so every deployment following the legacy configuration path presents the same publicly known SSH host identity. A standalone deployment is exposed only when a specific chain of non-default settings is met at once (sftp.enabled=true, sftp.enableAuth=true, no existingSshConfigSecret supplied, the legacy sftp.sshPrivateKey path selected, a valid config-ssh Secret permitting startup, and no overriding Ed25519 signer via hostKeysFolder); default all-in-one and non-authenticated standalone deployments never load the key and are unaffected. An attacker who already holds a traffic redirect or interception (MITM) position and whose victim client actually connects while trusting that published host identity could impersonate the SFTP endpoint and capture password credentials or data sent to the rogue server; there is no public exploit identified at time of analysis, and the high attack complexity, MITM positioning requirement, and mandatory user interaction keep real-world risk limited despite the 7.0 'High' CVSS 4.0 rating.
SQL injection in the version 1 Microsoft SQL node of the n8n workflow automation platform lets unauthenticated external callers execute arbitrary SQL against a connected database whenever a workflow binds untrusted input (for example, webhook fields) into the node's Query field via an expression. Affected deployments are n8n before 2.41.4 and the 2.42.x line before 2.42.1; exploitation is strictly gated on that specific insecure workflow configuration (AT:P), so default installs and workflows that use parameterised inputs are not exposed. Injected statements run with the privileges of the credential stored in the node; no public exploit code and no confirmed active exploitation were identified at time of analysis.
An out-of-bounds write in the Linux kernel's drop_monitor subsystem (reset_per_cpu_data()) lets a local user who holds CAP_NET_ADMIN and can drive the drop_monitor genetlink interface overrun a netlink message's tailroom by 4 bytes, corrupting skb_shared_info and typically crashing the kernel. Only systems built with CONFIG_NET_DROP_MONITOR are reachable, and the affected code has been present since the 2.6.31 era; the overflow is a fixed 4-byte zero write rather than attacker-controlled data, and triggering it is rated high-complexity, so the practical outcome is most likely a local denial of service with limited integrity impact. There is no public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is only 0.22% (12th percentile); vendor patches are available in the stable releases listed below.
Multiple Rakuten Mobile Android handsets - Rakuten Mini, Rakuten Hand, Rakuten Hand 5G, and Rakuten Bigs - ship with AOSP default test keys still trusted by Android Verified Boot, so a system image signed with those publicly known keys passes boot integrity verification instead of being rejected. An attacker with physical possession of the handset and the ability to enter its flashing/fastboot mode can therefore install a crafted system image and gain full control of confidentiality, integrity, and availability (VC:H/VI:H/VA:H), which is the basis for the CVSS 4.0 base score of 7.0 (HIGH), gated heavily by the AV:P physical-access prerequisite. There is no public exploit code identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); the risk is concentrated in lost, stolen, seized, or resold devices rather than any remote or network-reachable attack path.
Local privilege escalation in Akamai Guardicore Platform Agent (GPA) on macOS before version 7.4 allows an attacker with administrative privileges to execute arbitrary commands as root by exploiting a command injection in the wapptunneld component. The vulnerability requires local access and high privileges (PR:H), and exploitation necessitates that the 'Log out from your IdP' action is triggered after a malicious network interface name is set. No public exploit code or active exploitation has been identified; this is a genuine but bounded risk limited to unpatched macOS deployments.
Local privilege escalation in the SUID-root mount(8) utility shipped with util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, where the attacker-controlled LIBMOUNT_FORCE_MOUNT2 environment variable is read with getenv() and can force the legacy, non-atomic multi-step bind-mount path. On hosts whose /etc/fstab contains a bind mount authorized for unprivileged use via the user or users option and hardened with nosuid, noexec, or nodev, a local low-privileged user can win a timing race between the initial bind mount and the follow-up remount that applies those protective flags, briefly exposing an unprotected mount from which a SUID binary can be executed to obtain root. Exploitation is conditional (it requires that specific non-default fstab configuration) and non-deterministic because it depends on a race window; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV). Vendor-released patches are available in util-linux 2.41.5 and 2.42.2.
Local privilege escalation to root in util-linux's libmount affects versions 2.17 through 2.41.6 and 2.42 through 2.42.3, and also 2.42.4 when the legacy mount(2) path is used without /proc available. A local, low-privileged user who is already authorized by an /etc/fstab entry carrying the user or users option can exploit a time-of-check/time-of-use race: libmount validates the fstab target path and then the mount operation re-resolves that pathname, so an attacker who controls a writable ancestor directory can use renameat2(RENAME_EXCHANGE) to swap a path component and redirect the authorized mount to a root-owned location such as /etc/sudoers.d, gaining root. Exploitation is local only, requires the attacker to already hold an fstab mount authorization plus a writable ancestor on the configured target, and depends on winning the race (assessed AC:H), so it is non-deterministic; patched code paths using the new mount API (2.41.5 / 2.42.2 and later) or 2.42.4 with /proc present are not affected, and no public exploit identified at time of analysis.
Case routing rule conditions in BottleCRM 0.43 through 1.14.5 accept unbounded regular expressions that are evaluated by _match_condition() every time a case is saved, so an authenticated organization administrator can insert a catastrophically backtracking pattern and pin or exhaust Django web workers, producing a denial of service. Because those worker processes are shared across all tenants on a deployment, the impact of one organization's admin reaches unrelated customers, which is why the assessed CVSS 3.1 vector marks scope as changed (S:C) with high availability impact and no confidentiality or integrity loss. Exploitation requires a high-privilege authenticated account (PR:H, organization administrator able to create routing rules) and the routing-rules feature being in active use, but needs no user interaction; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the 6.9 base score places this as a moderate, availability-only risk.
Local privilege escalation in util-linux's SUID mount utility affects versions 2.39 through 2.41.4 and 2.42 through 2.42.1: a local, already-authorized low-privileged user can win a narrow timing race in the post-mount hook and redirect a privileged chmod()/lchown() onto a root-owned path, potentially obtaining root privileges. Exploitation requires a non-default /etc/fstab entry that combines the 'user' or 'users' mount option with an X-mount.mode, X-mount.owner, or X-mount.group option, plus write access to a writable ancestor directory of the mount target; the race itself is difficult (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released fixes in 2.41.5 and 2.42.2.
Stored cross-site scripting in n8n's Chat Trigger hosted-chat page lets an authenticated workflow author (PR:L) inject arbitrary markup through the customCss parameter, which is interpolated unsanitized into the page and executes on the n8n instance origin in the browser of any signed-in visitor who loads the published chat. The chat itself can be published without n8n user authentication, so the poisoned page is reachable by any visitor, but the impact lands only on authenticated visitors whose sessions share the instance origin. Affects n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1; rated CVSS 4.0 base 7.0 (CWE-79), and no public exploit identified at time of analysis.
Path traversal in sar2html 4.0.0's file upload handler (updateDb function in sar2html.py) allows unauthenticated remote attackers to write uploaded files outside the intended storage directory by supplying crafted filenames or paths. The impact is limited to low file integrity and availability loss (CVSS 4.0 base 6.9); there is no confidentiality impact or code execution. No public exploit has been identified at the time of analysis and the project has not responded to the issue report, so no vendor patch is available.
Unbounded server-side memory growth in stateful Streamable HTTP servers built on the MCP Python SDK (the 'mcp' package on PyPI) lets any client that can reach the endpoint exhaust process memory and force a restart. Versions 1.8.0 and later on the affected lines - including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager - retain session entries (with their parsed initialize parameters) that are never aged out or capped, so repeated ordinary short requests accumulate indefinitely; the CVSS 4.0 base score of 6.9 reflects availability-only impact, and no public exploit code has been identified at time of analysis. Stateless HTTP, stdio, and SSE transports are not affected, and the issue is fixed in versions 1.30.0 and 2.2.0.
Memory exhaustion denial of service in Juniper Networks Junos OS and Junos OS Evolved running on QFX5K-family platforms allows a device that is already a configured EVPN peer to leak memory in the l2ald process by driving EVPN-VXLAN active-active multihoming route processing, eventually starving the daemon and degrading or knocking over the switch. This is a medium-severity, availability-only issue (CVSS 6.9; assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) with no data disclosure or modification; there is no public exploit identified at time of analysis, though the assessed vector requires the attacker to hold an established EVPN peering relationship within the fabric rather than being an arbitrary internet host. A vendor patch is available, so only unpatched QFX5K devices with EVPN-VXLAN active-active multihoming configured and reachable by a peer are exposed.