CRLF injection in Eclipse Vert.x's vertx-mail-client (io.vertx:vertx-mail-client) lets a remote, unauthenticated attacker inject arbitrary email headers - Bcc, Reply-To, Content-Type, or entirely new headers - or prepend body content to an outgoing SMTP message whenever the host application passes attacker-controllable data into the library's header or MIME metadata APIs. Affected ranges are 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0; the realistic consequence is message-integrity compromise (silent copy redirection, header spoofing, MIME structure tampering) rather than the remote code execution implied by the accompanying 'RCE' tag. No public exploit code was identified and no confirmed active exploitation is recorded at time of analysis, and exploitation depends entirely on whether the embedding application forwards unsanitized user input into mail header fields.
Malformed XML parsed through NGINX JavaScript (njs) xml.parse() leaks libxml2 parser contexts, allowing unauthenticated remote requests to cause gradual, unbounded memory growth in long-lived NGINX worker processes and potentially leading to worker termination or denial of service. This is a moderate-severity data-plane issue and is exploitable only in deployments where the optional njs module is loaded and configured JavaScript logic calls xml.parse() on attacker-supplied XML; no public exploit identified at time of analysis. The independent assessment confirms remote unauthenticated reachability with low availability impact, and explicitly notes that the control plane is not exposed.
Out-of-bounds read in the OpenSIPS rtpproxy module (versions up to 3.6.8 and 4.0.1) allows unauthenticated remote attackers to trigger memory disclosure or a process crash via crafted SDP content processed by rtpproxy_offer() or rtpproxy_answer(). Exploitation requires the rtpproxy module to be loaded and its functions invoked in the routing script on attacker-reachable SIP transactions; no public exploit code has been identified at time of analysis, and no code execution is indicated. This medium-severity issue is fixed in OpenSIPS 3.6.9 and 4.0.2.
Remote unauthenticated attackers can exploit a hard-coded SECRET_KEY in sar2html 4.0.0 to bypass authentication and manipulate sessions, though the real-world impact is limited to low-severity partial compromise. The flaw (CWE-259) affects all instances using the static key in sar2html.py, which is publicly visible in the GitHub repository. No public exploit code has been identified, and the project has not released a fix despite being notified.
Junos OS Evolved releases before the fixed builds listed in Juniper advisory JSA112171 unintentionally bind an internal-only process to a network-reachable port, letting an unauthenticated, network-based attacker achieve limited information disclosure and increase CPU consumption through ingress packet processing. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, score 6.5) confirms no authentication or user interaction is required, but exploitation is constrained by whether the exposed port is actually routable from the attacker's position; devices with that port firewalled or limited to internal/management networks are not practically exploitable. No public exploit has been identified at time of analysis and CISA KEV does not list this issue, so the risk is best characterized as moderate and exposure-dependent rather than an active compromise campaign.
SQL injection in cemtan sar2html 4.0.0 lets remote attackers inject arbitrary SQL through the s2host argument processed by the updateDb function in sar2html.py (Archive Processing component); the CVSS vector indicates the attack is unauthenticated and requires no user interaction (PR:N/UI:N). Impact is bounded to limited confidentiality, integrity, and availability loss (CVSS 3.1 base 6.9-equivalent scope: C:L/I:L/A:L), constrained further by the privileges and contents of the backend database the application queries. No public exploit code has been identified at time of analysis, and no vendor patch is available - the project was notified via an issue report and has not responded.
Heap out-of-bounds read in TinyEXR through 3.2.0 occurs when ParseEXRMultipartHeaderFromMemory() processes a crafted multi-part EXR file and a later part header carries a stale remaining-size value, bypassing ReadAttribute() bounds checks. The flaw is locally delivered and requires a victim to open or process the malicious EXR file in an application that uses the library, resulting in a likely application crash and only limited disclosure of adjacent heap memory into parsed attribute values; no code execution or data integrity impact is indicated. This is a moderate-severity memory-safety issue (CVSS 6.9) affecting any tinyexr-consuming application that accepts untrusted multi-part EXR input, with no public exploit identified at time of analysis.
Remote, unauthenticated data injection into upstream requests affects NGINX Plus and NGINX Open Source deployments that terminate HTTP/3 via the ngx_http_v3_module and have the proxy_request_buffering on directive active on the proxied location. An attacker able to reach such a listener can cause attacker-controlled bytes to be blended into the request forwarded to the backend, an integrity-only problem (CVSS 4.0 base 6.9; independent CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) with no confidentiality loss, no availability loss, and, per F5, no control-plane exposure. Exposure is sharply narrowed because HTTP/3 is not enabled in default nginx builds and exploitation requires both a QUIC listener and request buffering; no public exploit has been identified at time of analysis.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent BGP peer crash rpd and cause a denial of service by sending a crafted set of BGP communities. Per the CVSS vector (AV:A/PR:L) the attacker must already sit within the routing trust boundary with an accepted BGP peering session rather than being an arbitrary internet host, and exploitation additionally requires BGP to be configured on the target and the device to add the graceful-shutdown sender community while advertising a route. The impact is availability only (no confidentiality or integrity effect), rated 6.8 (Medium); confirmed actively exploited status is not indicated, and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority availability issue rather than a top-tier emergency.
A double free in L-SMASH through 2.14.5 lets a crafted media file corrupt the heap: the HEVC and H.264 importer probe routines hevc_setup_first_summary() and h264_setup_first_summary() (importer/nalu_imp.c) free borrowed codec-specific objects on error paths, so an Annex-B elementary stream that deliberately lacks a parseable SPS drives a use-after-free, heap corruption, and crash when opened via lsmash_read_file() or the bundled boxdumper, remuxer, or muxer tools. The flaw rates CVSS 4.0 6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H) and CWE-415, and per the independent assessment exploitation is local and requires a user or operator to open or pipe the malicious file, with impact realistically confined to workflows that feed untrusted media into L-SMASH-based transcode/remux pipelines; no public exploit code and no CISA KEV entry were identified at time of analysis, i.e. no public exploit identified at time of analysis.
Improper input validation in Nodemailer's address parser allows crafted recipient addresses to bypass domain allow-list checks and inject illegal characters into SMTP envelope commands, potentially causing email delivery failures or domain allow-list bypass. Affected versions are 3.0.0 through 10.0.12; the issue is remotely exploitable without authentication (PR:N) but requires an application that accepts attacker-influenced recipient input and relies on domain validation. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is integrity-only.
Script injection in Markdown Preview Enhanced (a Visual Studio Code extension) before 0.8.30 lets a malicious repository execute attacker-controlled JavaScript inside the preview webview as soon as a victim opens a Markdown preview. Because the injected code runs before the React application and DOMPurify are initialized, it can reach acquireVsCodeApi() and send arbitrary messages to the extension host, giving an attacker host-level command influence (integrity impact is rated High in the assessed vector). Exploitation requires the extension to be installed, the victim to have an attacker-controlled repository on disk, and the victim to open a preview of a Markdown file in that repository - the preview itself is the trigger and no further click is needed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the vendor-released fix is 0.8.30, which upgrades the bundled crossnote library to 0.9.31.
Heap out-of-bounds reads in libpff through 20260926 allow attackers to crash applications (denial of service) and disclose adjacent heap memory by delivering crafted PST, OST, or PAB files that contain multi-value properties with non-monotonic offsets. Exploitation requires the victim to open or process the malicious file with libpff, the pypff bindings, or the pffexport tool; the flaw is local (AV:L) with passive user interaction (UI:P) and no authentication required (PR:N). No public exploit code was identified at time of analysis, and the impact is bounded to denial of service and information disclosure-not code execution, integrity compromise, or remote exploitation.
Symlink-following in GitPython 3.1.62 through the 3.1.x line (up to but not including 3.2.0) lets a repository author plant a committed symbolic link - such as a 'vendor' entry resolving outside the worktree - and then have an application that calls Submodule.move() on an already-initialized submodule relocate that checkout outside the repository, corrupting the working tree, the Git index, and .gitmodules. This is a moderate-severity integrity flaw rather than a high-priority emergency: it is local-only, unauthenticated in the CVSS sense (PR:N) but requires user interaction since the victim application must actively perform the move against attacker-controlled content, and there is no confidentiality loss. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; exposure is limited to applications that invoke Submodule.move() on untrusted repositories.
Local users with regular (non-admin) access to a host running Trellix Agent 5.8.4 can decrypt the agent's database by exploiting a hardcoded cryptographic key in mfecryptc.dll. The flaw requires local interactive access and cannot be triggered remotely; impact is limited to information disclosure with no availability or integrity loss. No public exploit code has been identified at time of analysis, and CISA KEV does not list this vulnerability.
Server-side request forgery in InvoiceShelf before version 2.4.0 lets an authenticated owner-level administrator point the user-controlled gotenberg_host setting at arbitrary internal addresses, causing the application to POST rendered invoice, estimate, or payment HTML to that destination during PDF generation. Affected deployments are those running a version prior to 2.4.0 with the Gotenberg PDF driver enabled; the assessed vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N (CVSS 6.8), so the attack is gated behind high privileges and requires a PDF render to actually occur. No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation; the primary risk is internal service and cloud metadata (169.254.169.254) reachability plus exfiltration of customer names, addresses, line items, totals, and company identifiers to an attacker-chosen host.
Out-of-bounds write in the Zephyr CC1200 sub-GHz IEEE 802.15.4 driver lets an unauthenticated attacker within radio range transmit a frame whose first byte declares a PHY length above the IEEE 802.15.4 maximum of 127, driving an oversized net_buf allocation and a single SPI burst that can write up to 127 bytes past the end of the first 128-byte buffer fragment. The flaw affects builds that enable CONFIG_IEEE802154_CC1200 with a physically attached CC1200 radio in the driver's default variable-length mode (PKT_LEN = 0xFF), and exploitation is constrained by RF framing/timing requirements (CVSS 3.1 AV:A/AC:H/PR:N/UI:N, CWE-787), with the resulting overflow containing FIFO-underflow bytes so the realistic outcome is network-buffer-pool corruption and crashes rather than a controlled write. An upstream fix is available as a commit to verify_rxfifo_validity(), but no public exploit code or confirmed active exploitation was identified at time of analysis, and no independently confirmed tagged release containing the fix is documented here.
NULL pointer dereference in the xlsxio C library (through version 0.2.37) lets a crafted .xlsx file crash any application that parses it with xlsxioread_sheet_open(), causing a denial of service. The trigger is a workbook.xml.rels file containing a worksheet Relationship element that omits the required Id attribute, which makes main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c dereference a NULL attribute pointer. Exploitation is rated moderate at CVSS 4.0 base 6.8 (availability-only, no confidentiality or integrity impact) with unauthenticated local access and passive user interaction; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV, so real-world risk is low-to-moderate and confined to software that opens untrusted spreadsheets with this library.
Privilege retention in FileRise prior to 3.16.0 lets a demoted administrator keep administrator access by replaying a remember-me token that was issued while the account still held the administrator role. An authenticated attacker who possesses such a pre-demotion token and whose account was demoted rather than deleted can be restored to full administrative privileges through the automatic (remember-me) login path, because the application trusts the isAdmin flag stored in the token instead of re-resolving the account's current role from users.txt; token rotation copies the stale privilege into every replacement token. No public exploit code has been identified at time of analysis, and the flaw is fixed in version 3.16.0 per the vendor advisory and the referenced commit.
Crafted TrueType fonts crash applications that embed or link libschrift through 0.10.2, either by setting the head-table unitsPerEm field to 0 or by carrying NaN glyph coordinates that slip past clip_points() and force an out-of-bounds raster read in draw_line() during sft_render(). Exploitation requires no privileges (PR:N) but the malicious font must reach a local rendering context and actually be rendered by the victim application (CVSS 4.0 6.8, AV:L/UI:P; independent assessment: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), so there is no self-propagating or fully unauthenticated remote path. Impact is availability only: the rendering process terminates, with no code execution, data disclosure, or integrity loss. Public exploit code has not been identified at time of analysis, although a public technical write-up describes the trigger conditions, and the issue is not listed in CISA KEV.
Server-side request forgery in the self-hosted CORS proxy worker bundled with BentoPDF (cloudflare/cors-proxy-worker.js) through version 2.8.6 lets an unauthenticated remote attacker who controls authoritative DNS for a domain with a very low TTL win a DNS-rebinding race and make the proxy fetch internal, loopback, link-local or cloud-metadata addresses, returning the response body to the attacker. Exploitation is highly conditional: the worker must be running outside Cloudflare (for example workerd, Node, or another runtime inside a cloud VPC that can actually route to RFC1918 and 169.254.169.254 addresses), PROXY_SECRET validation must be disabled, no network-level egress filtering may be present, and the attacker must supply a certificate, OCSP, CRL or TSA URL that passes the proxy's accepted path checks. The default Cloudflare deployment is not exploitable, redirects and IP-literal obfuscation are blocked, and impact is limited to read-only information disclosure (C:H/I:N/A:N); the issue is fixed in 2.8.7 and no public exploit was identified at time of analysis.
Uninitialized heap memory disclosure in 7-Zip's SquashFS v4 archive handler (SquashfsHandler.cpp) allows an attacker to leak process memory contents by supplying a crafted archive that a victim then lists or extracts. The flaw is triggered in any 7-Zip build before 26.03 when the SquashFS superblock's no_ids field is manipulated so the final metadata block's expected size is miscomputed and slips past the handler's size validation check, causing uninitialized heap bytes to be surfaced as the kpidUserId and kpidGroupId properties. Exploitation requires local processing of an attacker-supplied file plus mandatory user interaction (opening, listing, or extracting the archive), no authentication is required, and the impact is limited to information disclosure with no code execution, integrity, or availability effect; no public exploit identified at time of analysis, and the issue rates as moderate rather than emergency priority.
Denial of service in the quirc QR-code decoding library (versions through 1.2) allows an attacker who supplies a crafted QR image to hang the decoder in quirc_end(), pinning a CPU core for an effectively unbounded time. The excessive-iteration flaw lives in find_alignment_pattern() in lib/identify.c: a slide of three finder patterns can produce a near-degenerate perspective transform whose near-zero denominator inflates size_estimate, driving the alignment-pattern spiral through billions of region_code() iterations on a tiny image. Impact is availability-only (CVSS 4.0 VC:N/VI:N/VA:H; assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H): no authentication is required, but exploitation needs the host application to actually decode attacker-controlled image data (UI:P / UI:R passive interaction), so exposure is limited to services or apps that automatically run quirc over untrusted uploads; no public exploit was identified at time of analysis, though a public technical writeup of the loop condition exists and an upstream fix has been published as PR #159.
Excessive resource consumption in OW2 ASM versions 1.4.3 through 9.10.x allows an unauthenticated local attacker to trigger a denial of service by supplying a crafted Java class file that is analyzed through Analyzer.analyze() with the BasicVerifier, SimpleVerifier, or SourceInterpreter implementations. The flaw, tracked as CWE-770, causes unbounded per-instruction Frame allocation and fix-point iteration, exhausting memory and CPU; exploitation requires the victim application to invoke the analysis path (user interaction) and is limited to availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is rated medium severity with a vendor patch available in ASM 9.11.
Denial of service in OW2 ASM versions 3.0 up to but not including 9.11 allows a crafted legacy class file with nested JSR/RET subroutines to trigger uncontrolled O(2^n) memory allocation in asm-commons JSRInlinerAdapter, crashing the JVM with OutOfMemoryError. The CVSS vector indicates no privileges required (PR:N) and user interaction, but the attack is local (AV:L) and not remotely triggerable: a victim process must process an attacker-supplied class file locally, and impact is availability-only with no code execution, data disclosure, or integrity loss. No public exploit identified at time of analysis; vendor patches are available for the affected range.
Uncontrolled recursion in OW2 ASM's SignatureReader.parseType() lets an attacker crash any application that reads or transforms a malicious Java class file, exhausting the stack with deeply nested generic type arguments in the class's Signature attribute. Versions 3.0 through 9.10.x (everything before 9.11) are affected; the flaw is availability-only, yielding at worst a StackOverflowError that kills the processing thread or service, with no confidentiality or integrity impact. Exploitation is local-vector and requires the victim application to actively ingest the crafted bytecode, for example through uploaded plugins, user-submitted classes, third-party build artifacts, or instrumentation input; there is no public exploit code identified at time of analysis and no indication of confirmed active exploitation (CISA KEV), and deployments that only ever parse trusted first-party bytecode are not realistically exposed.
CPU exhaustion in the OW2 ASM Java bytecode library (versions 3.0 through 9.10.x) lets attackers who can supply crafted class files stall bytecode-transforming threads for an unbounded amount of time whenever ClassWriter is used with the COMPUTE_FRAMES option. The crafted methods force the fix-point algorithm in MethodWriter.computeAllFrames() to converge very slowly, consuming CPU indefinitely; only availability is affected, with no confidentiality or integrity impact. The attack path is local and requires passive user interaction (a user or application must feed the crafted file into the ASM transformation call path), so exposure is limited to deployments that recompute frames on untrusted or externally influenced bytecode. Patch available per the vendor advisory, and no public exploit identified at time of analysis.
Denial of service in OW2 ASM versions 3.0 through 9.10.x allows a crafted class file to exhaust JVM heap memory when an application analyzes untrusted bytecode with the ClassWriter COMPUTE_MAXS or COMPUTE_FRAMES option enabled. A malicious class containing thousands of overlapping exception handlers triggers quadratic Edge allocation inside MethodWriter.computeMaxStackAndLocal() and computeAllFrames(), producing an OutOfMemoryError that crashes the JVM. The vendor scores this CVSS 4.0 6.8 (AV:L, PR:N, UI:P) with high availability impact only, and no public exploit or confirmed in-the-wild exploitation has been identified; the attack is bounded by the requirement that the victim application load attacker-controlled bytecode through ASM's frame-computation path.
Denial of service in OW2 ASM versions 3.0 through 9.10.x (prior to 9.11) allows an attacker to crash applications that transform untrusted Java class files by supplying a class with a large method containing many long forward jumps, which triggers unbounded recursion in ClassWriter.replaceAsmInstructions() and a StackOverflowError during toByteArray(). The issue is rated moderate severity (CVSS 6.8) and requires the target application to process attacker-controlled bytecode through ClassWriter's transformation path; no public exploit code or active exploitation has been identified, and a vendor patch is available in ASM 9.11. The attack vector is local and requires passive user interaction, with impact limited to availability.
Denial of service in OW2 ASM (versions 3.0 up to but not including 9.11) allows an attacker who can get a crafted Java class file into the library's bytecode parsing pipeline to trigger a roughly 2 GB heap allocation that crashes the JVM. The root cause is that Label.addSubroutineRetSuccessors() fails to enforce ASM's single-RET-per-JSR invariant, so a malformed class file containing multiple RET instructions for one JSR expands the successor set to an enormous size (CWE-789, excessive memory allocation). Impact is availability-only - no code execution or data disclosure - and exploitation requires an application that hands untrusted class files to ASM and reaches the legacy JSR/RET parsing path; the vendor CVSS 4.0 base score is 6.8 (AV:L, UI:P, PR:N), and the independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, i.e. medium severity and availability-only. No public exploit identified at time of analysis, and there is no evidence of active exploitation.
Denial of service in OW2 ASM 5.0 through 9.10.x allows an attacker who can supply a crafted Java class file to trigger excessive memory allocation while ClassReader parses a BootstrapMethods attribute, causing an OutOfMemoryError that crashes the JVM or the consuming thread. This is a pure availability issue (CVSS 6.8, CWE-789) with no code execution, data disclosure, or integrity impact, and it requires the victim application to parse untrusted bytecode (PR:N, UI:P/UI:R). No public exploit was identified at time of analysis; a vendor patch is available.
Authenticated archive extraction in FileRise prior to 3.23.0 can overwrite and then delete files outside the configured storage root, but only when the destination folder already contains a symlink pointing to a directory outside that root. Exploitation requires a low-privileged but authenticated (PR:L) account holding 'extract' permission that can also place an attacker-controlled ZIP, 7z, or RAR in the affected folder, plus a pre-existing symlink the advisory does not establish the attacker can create; the FileRise OS process must also already hold write or delete permission on the external target, which is why attack complexity is rated high (AC:H) despite the network vector. The resulting CVSS 3.1 base score is 6.8 (Medium) with high integrity and availability impact and no confidentiality impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Site administrators on a WordPress Multisite network can strip the two-factor authentication configuration of user accounts belonging to other sites - including accounts they are not permitted to edit - in the WP 2FA plugin before version 4.2.0, because the 2FA-removal routine is missing an object-level capability check (CWE-639). The issue is scored CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) and only crosses a genuine trust boundary on Multisite installs, since single-site administrators already manage all users; publicly available exploit code exists, but there is no indication of active exploitation and EPSS is only 0.22% (12th percentile). Impact is limited to removing - not reading, forging, or bypassing inline - another user's 2FA configuration, which weakens that account's authentication posture for as long as the victim does not notice and re-enroll.
An out-of-bounds write in the eventd relay service of Juniper Junos OS and Junos OS Evolved allows an attacker who already holds high-privilege local access on the device to crash the event-processing daemon, causing a denial of service. Our independent assessment (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) confirms the attack is local rather than remote, requires high privileges, needs no user interaction, and affects availability only with no confidentiality or integrity impact and only a low downstream system-availability effect. There is no public exploit identified at time of analysis, no CISA KEV entry confirms active exploitation, and the vendor-rated CVSS 4.0 base score of 6.7 places this in the medium-severity range.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved results from a NULL pointer dereference in the na-grpcd process, which crashes when it receives a crafted network message, making the services that depend on that daemon unavailable on the affected device. Exploitation requires network reachability into the chassis-internal (control-plane fabric) network, which is not normally exposed to WAN or ordinary management networks, so real-world exposure is limited; the advisory describes an unauthenticated attacker while the published CVSS 4.0 vector lists PR:H, leaving the precise account-level requirement ambiguous - the concrete gating condition is privileged access to the internal chassis network. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed software under advisory JSA112187.
Unauthenticated denial of service in Palo Alto Networks PAN-OS lets any attacker who can reach a dataplane interface cause availability loss by sending specially crafted network traffic to or through that interface; a single attempt causes a DoS condition, and repeated triggering drives the firewall into maintenance mode. Only PAN-OS itself is affected - Palo Alto explicitly states Cloud NGFW and Panorama are not impacted - and the impact is availability-only, with no data exposure, tampering, or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis (CVSS 4.0 exploit-maturity value E:U, meaning no reported exploit), and the vendor's CVSS 4.0 base score of 6.6 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) aligns with the independent assessment of CVSS 3.1 7.5 with PR:N/UI:N and availability-only impact.
Arbitrary file write in @appium/support (Appium) prior to 7.2.6 lets a crafted ZIP archive escape the intended extraction directory by first planting a symbolic-link entry that points outside that directory and then adding a regular-file entry whose legitimate name resolves through the link; because the pre-fix containment check validated only entry names lexically, neither '..' segments nor absolute paths are required. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), the attack is network-deliverable and unauthenticated but requires an operator or automated pipeline to actually trigger extraction of the hostile archive, and the write is confined to locations writable by the Appium process - overwriting configuration, startup scripts, or executables can escalate to code execution depending on that writable target. Vendor-released patch: @appium/support 7.2.6; no public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.
Path traversal in the Dell Unisphere for PowerMax vApp 9.2.4.x management appliance allows an authenticated low-privileged remote attacker to read files outside the intended restricted directory, resulting in information disclosure. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network reachability, low attack complexity, no user interaction, and confidentiality-only impact, with valid appliance credentials as the primary prerequisite for exploitation. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; risk is highest where the management interface is reachable by many lower-tier users and reduced where access is network-restricted to trusted administrators.
Denial of service through process abort and reset in NASA's F´ (F Prime) framework affects all versions prior to 4.3.0 when a deployment bridges events across address spaces via Svc::GenericHub into Svc::EventManager. A legal Fw::LogBuffer whose size approaches the framework LogBuffer maximum leaves insufficient room in the destination ComBuffer once the packet descriptor, event identifier, and time-tag metadata are serialized, so serialization returns a failure status that reaches the standard F Prime FW_ASSERT and terminates the process. The flaw is adjacent-network reachable (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.5), requires no privileges, and yields availability impact only; no public exploit code was identified at time of analysis, and the vendor-released fix is version 4.3.0.
OS command injection in Dell Unisphere for PowerMax vApp 9.2.4.x lets a remote attacker who already holds a high-privileged (administrative) account on the appliance run arbitrary operating-system commands on the underlying host. Because the CVSS vector requires PR:H and AC:H, exploitation is gated on prior admin-level authentication plus network reachability of the Unisphere management plane and additional conditions outside the attacker's control, so the practical risk is concentrated among insiders or attackers who have already compromised privileged credentials rather than the general internet. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the vendor has published a security-update advisory (DSA-2026-447) covering this and related PowerMax product vulnerabilities.
Command injection in Dell Unisphere for PowerMax vApp (versions 9.2.4.x) allows a high-privileged remote attacker to execute arbitrary commands, achieving remote code execution. Exploitation requires prior administrative access (PR:H) and high attack complexity (AC:H), limiting risk to insiders or attackers who have already compromised an admin account. No public exploit or active exploitation has been identified, and the CVSS score is 6.6 (moderate).
Unauthenticated OS command injection in WeGIA prior to 3.8.6 lets remote attackers execute arbitrary commands as the web-server user through the pre-installation web/instalador/instalador.php endpoint, which remains reachable whenever ../config.php has not yet been created. The attacker submits the Linux reinstall flow with a crafted 'usuario' POST value containing shell metacharacters that is interpolated into a shell_exec() mysql import command; the same endpoint also writes attacker-controlled values into an executable config.php and concatenates the 'nomebd' database name into a CREATE DATABASE statement. Exploitation is gated by a deployment-state precondition - the installer only processes POST data while config.php is absent, and the command sink is reached only on Linux - which the CVSS:3.1 vector's AC:H reflects; no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and authentication requirements are unauthenticated per the PR:N vector.
Denial of service in NASA's F´ (F Prime) flight software framework prior to 4.3.0 allows an adjacent, unauthenticated attacker to abort or reset the flight process by issuing a crafted Svc::FileDownlink SendPartial command. The command's startOffset and length are summed in 32-bit arithmetic without an overflow check, so a length that wraps the sum below the size of an existing but larger source file is accepted, storing a wrapped m_endOffset that is inconsistent with m_byteOffset; under standard F Prime assertion handling the first data-packet transition reaches FW_ASSERT and terminates the process. This is an availability-only issue (CVSS 6.5, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - no confidentiality or integrity impact), the vendor has released a fix in 4.3.0, and no public exploit was identified at time of analysis.
Zulip Server through 12.1 delivers new-message events to guest-role users for public (non-web-public) channels they are not subscribed to, allowing a guest to read the content of those messages. An authenticated guest can trigger disclosure by registering an event queue whose narrow parameters target an unsubscribed public channel, or by keeping an existing queue alive after their access to the channel is revoked, since the server fails to filter guest clients out of those events (CWE-862, missing authorization). Web-public channels and private channels are not the target of the flaw. Vendor-released patch: Zulip Server 12.2; no public exploit code has been identified at time of analysis.
FileRise versions prior to 3.21.0 track failed logins only as a source-IP plus username pair, so a remote unauthenticated attacker can rotate usernames to obtain a fresh failed-attempt budget for every account name attempted, enabling password spraying from a single source beyond the intended limit. Per-username limits still apply, which can additionally produce distinguishable throttling behavior against targeted accounts and aid username discovery. Rated CVSS 6.5 (medium), with no public exploit code identified at time of analysis and no evidence of active exploitation; the weakness degrades brute-force protection rather than bypassing authentication itself, so real-world impact depends on whether weak or guessable credentials exist on target accounts.
An out-of-bounds write in GStreamer's H.266/VVC Decoding Capability Information (DCI) parser inside libgstcodecparsers allows a remote attacker to crash or corrupt memory in any third-party application that directly calls the affected parsing API by supplying a crafted H.266 bitstream whose reserved DCI field carries an illegal value the parser wrongly accepts. Red Hat rates it CVSS 6.5 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) - network-reachable, unauthenticated and requiring no user interaction per the supplied vector, but with only Low integrity and Low availability impact and no confidentiality loss, consistent with a bounded out-of-bounds write (CWE-787). Exposure is sharply limited: the description states no standard GStreamer pipeline element invokes this code path, so default GStreamer installations and ordinary playback pipelines are not exploitable, and no public exploit has been identified at time of analysis.
Denial of service in NASA's F´ (F Prime) flight software framework before version 4.3.0, where an integer-overflow flaw in Svc::FileDownlink's SendPartial range validation lets a caller with command authority over the SendPartial command crash the running flight software process. When an on-board source file is larger than the supplied startOffset and the caller supplies a length whose unsigned 32-bit sum with that offset wraps, the wrapped value passes validation and is stored as m_endOffset while m_byteOffset remains larger, so the first data-packet send hits FW_ASSERT and aborts or resets the process. The issue is authenticated (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), availability-only, fixed in 4.3.0; no public exploit identified at time of analysis.
Heap memory corruption in Qt for MCUs (Qt Quick Ultralite) can produce a double free, invalid free, or use-after-free when an application passes text stored in a std::string into the public Qul::String interface, because the conversion copies the pointer without taking ownership and two objects subsequently release the same allocation. The assessed impact is high integrity and availability loss with only limited confidentiality exposure, and exploitation requires that the target application actually use this specific std::string-backed API pattern - no privileges or user interaction are otherwise needed. The vendor rates it 6.5 (Medium) under CVSS 4.0 with attack requirements present (AT:P); no public exploit code or confirmed active exploitation was identified at time of analysis, and the reference set provides only a Qt wiki advisory listing rather than a fix version.
SQL injection in WooCommerce Polylang Integration plugin versions up to and including 1.5.0 allows authenticated attackers with Subscriber-level access to extract sensitive information from the WordPress database via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action. The flaw requires the plugin to be active and a low-privileged account, which is easily obtained on WooCommerce sites allowing customer registration. No public exploit code has been identified at time of analysis, and the impact is limited to data confidentiality.
JNews - Jeg Elementor Kit plugin for WordPress (up to and including 3.2.19) is vulnerable to unauthorized data access due to missing capability checks on the 'jkit_post_block' and 'jeg_find_author' AJAX actions. An authenticated attacker with Subscriber-level access or above can exploit this to enumerate all registered users and reconstruct arbitrary users' email addresses character-by-character using a substring search oracle. No public exploit code has been identified at time of analysis, and the issue requires an authenticated low-privilege account, making it a moderate-priority concern rather than a high-urgency emergency.