Stack-based buffer overflow in the authd process of Juniper Networks Junos OS allows an attacker who can influence a configured RADIUS server to crash the device or execute arbitrary code with root privileges. This unauthenticated, adjacent-network attack (CVSS 8.7) is limited to devices that have RADIUS authentication enabled and where the attacker either controls the RADIUS server or can inject or modify RADIUS responses on the adjacent network. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed (not in CISA KEV).
A stack-based buffer overflow in the Juniper Networks Junos OS dot1x daemon lets a network-adjacent attacker who is acting as the configured ICCP peer crash the daemon and potentially execute code as root - but only on devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity and availability impact; the vector is PR:N and AC:L, although in practice the attacker must hold a trusted position on the ICCP control fabric rather than obtain arbitrary remote access, and devices not running the Fusion aggregation role with dot1x sync are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this remains a genuinely serious issue for affected deployments but a narrow one in practice.
Adjacent, unauthenticated code execution as root affects Juniper Junos OS and Junos OS Evolved devices that support Secure-ZTP when their phone-home daemon (phcd) processes a crafted DHCP SZTP bootstrap message. The flaw is a stack-based buffer overflow (CWE-121) that can be triggered by a network-adjacent attacker (CVSS 4.0 AV:A/AC:L/PR:N/UI:N, vendor score 8.7 High); no credentials or user interaction are required, but the target must be a Secure-ZTP-capable platform actively in the DHCP SZTP bootstrap/provisioning state and the attacker must be on the same Layer-2/logical segment. Vendor patches are available; no public exploit code or KEV-listed active exploitation was identified in the provided data.
A stack-based buffer overflow in Juniper's jdhcpd process lets an adjacent, unauthenticated attacker crash or potentially achieve root-level code execution on Junos OS and Junos OS Evolved devices that are configured to use the DHCPv4 local-client feature. Exploitation requires the device to act as a DHCPv4 client and an attacker to sit on the same Layer 2 segment able to deliver a malformed DHCPv4 server response (for example via a rogue or spoofed DHCP server); there is no public exploit identified at time of analysis, but a vendor patch is available. Because jdhcpd runs with root privileges, a successful overflow could yield high confidentiality, integrity and availability impact, making this a mid-to-high priority issue for exposed deployments rather than a universal emergency.
Adjacent unauthenticated attackers can trigger a stack-based buffer overflow in the l2cpd process on Juniper Junos OS and Junos OS Evolved by sending crafted LLDP traffic to an interface configured with Unified Access Policy, potentially causing a denial of service or root-level code execution. Exploitation requires Layer-2 adjacency and the non-default UAP configuration, so this is a high-priority networking vulnerability rather than a universal emergency. No public exploit identified at time of analysis, and a vendor patch is available.
Denial of service in Juniper Networks Junos OS on MX Series routers equipped with SPC3 services line cards and configured for source NAT: the Packet Forwarding Engine fails to drop a specific malformed IPv6 packet and instead creates a session and allocates NAT resources, so sustained delivery of such packets exhausts the session/NAT pool and disrupts all traffic through the device until it is rebooted. The issue is remotely reachable and unauthenticated (no credentials and no user interaction required), and availability-only - there is no path to code execution or data disclosure. Exploitation is constrained by two non-default prerequisites, namely SPC3 hardware and an active source NAT configuration, and no public exploit code has been identified at time of analysis; impact is limited to the affected device profile, so this is a targeted operational-availability risk rather than a universal emergency.
Stack-based buffer overflow in NLnet Labs NSD's zone-file RDATA parser allows an attacker with the ability to supply a crafted primary zone file to perform out-of-bounds stack writes, including overwriting a callback function pointer that is invoked immediately after parsing, which can lead to arbitrary code execution. The vulnerable path requires direct ingestion of a specially formatted zone file; NSD-generated zone files, including those for secondary zones received by transfer, are not formatted in the triggering way and will not exploit the flaw. No public exploit code or confirmed active exploitation is identified in the available intelligence, and the assessed vector requires low privileges (PR:L) through local or zone-supply access rather than ordinary remote DNS queries.
Stack-based buffer overflow in the cfmd process of Juniper Junos OS and Junos OS Evolved on MX Series and PTX Series platforms enables unauthenticated adjacent-network attackers to execute arbitrary code as root or cause denial of service when enhanced CFM mode and a configured down-MEP are present. The CVSS 8.7 score reflects high confidentiality, integrity, and availability impact, but real-world exposure is constrained by the non-default CFM/802.1ag configuration and the need for Layer 2 adjacency; no public exploit identified at time of analysis.
Loading a crafted zone file into NLnet Labs NSD can overflow a stack buffer and overwrite up to 191 bytes with attacker-controlled data, which can corrupt control flow in the name server process and lead to code execution or a crash. The trigger is a HIP resource record whose RDATA is filled to (or near) its size limit and which also carries a second dname RDATA field, the HIP Rendezvous server; the bug lives in zone-file parsing, so it is not reachable through ordinary DNS query traffic, and zones NSD writes out itself - including secondary zones learned via zone transfer - are not formatted in the vulnerable way. Exploitation therefore requires the attacker to control zone-file content fed directly to NSD, for example through an operator-controlled provisioning or automation pipeline; no public exploit code was identified at time of analysis, and the vendor's CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, score 8.7) overstates practical remote risk relative to the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High). Authentication is required per the supplied vectors (PR:L), which corresponds in practice to a low-privileged position able to supply zone-file content to the daemon.
A stack-based buffer overflow in NLnet Labs NSD's parsing of SVCB/HTTPS resource records allows an attacker who can supply a crafted zone file to corrupt memory and potentially achieve arbitrary code execution. The flaw is triggered when the RDATA is filled to the wire-format limit and an ECH parameter overflows the stack, after which the base64 decoder can write attacker-controlled data of unlimited size. Exploitation requires that the crafted zone file be fed directly to NSD; zone files written by NSD itself (e.g., secondary zones) are not affected. The attacker must control or inject into the zone-provisioning path, such as a multi-tenant zone-submission pipeline, and authentication requirements are low-privileged per the CVSS vector (PR:L). No public exploit or in-the-wild exploitation has been identified at time of analysis.
Stack-based buffer overflow in NLnet Labs NSD is triggered when the daemon parses a zone file containing base64 data split into chunks of three characters or fewer, causing the token length calculation to yield zero bytes and letting an attacker overwrite up to 64K of stack memory with attacker-controlled data, with likely code-execution impact. Our independent assessment rates this CVSS 3.1 AV:L/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact, reflecting that the attacker must control zone-file content fed directly to NSD (PR:L, i.e., write/submit access to the zone input path) - it is not reachable through normal DNS queries and does not affect zone files NSD generates itself, such as zones for which the instance is secondary. The vendor rates it CVSS 4.0 8.7 (High) with AV:N/PR:L; patch availability is not confirmed in the provided data, and no public exploit code or CISA KEV activity was identified at time of analysis.
Eclipse NetX Duo's NetX Secure DTLS server can be driven into completing handshakes with forged source addresses because the cookie it issues in a HelloVerifyRequest is never actually validated: the ClientHello parser copies the client-supplied cookie bytes over the value the server generated, and the server then treats the peer as verified based on the cookie's length alone, so a single arbitrary cookie byte in the first ClientHello skips the return-routability exchange entirely. The defect is remotely reachable with no authentication and no user interaction (CVSS 4.0 base 8.7, High; the independent assessment confirms AV:N/AC:L/PR:N/UI:N with an availability-only impact), and the practical harm is anti-spoofing and availability abuse - spoofed-source handshakes, amplification potential, and handshake state/resource exhaustion - not data compromise or code execution. No public exploit code has been identified at time of analysis, and CVE-2026-106465 is not listed in CISA KEV.
Arbitrary file read in GitPython before 3.2.0 occurs when a vulnerable application clones an attacker-controlled repository and then calls Head.checkout() on the repository's default branch; a branch named like --pathspec-from-file=<path> is parsed by Git as an option rather than a branch, causing readable file contents to be leaked through GitCommandError messages. This is a credible but conditional information-disclosure flaw, not a drop-everything emergency: only confidentiality is affected, exploitation requires the target to process untrusted repositories and surface error output, and no public exploit identified at time of analysis. Unauthenticated network exploitation is possible per the PR:N vector, and the vendor patch is GitPython 3.2.0.
Denial of service in Nodemailer 3.0.0 through 10.0.12 lets a malicious or man-in-the-middle SMTP server stall the Node.js event loop by answering EHLO with a crafted '250-AUTH' line followed by a long whitespace run and a non-matching token, which drives quadratic backtracking in the four AUTH-mechanism detection regexes in SMTPConnection._actionEHLO. No authentication is required from the attacker (PR:N) and the trigger occurs before any authentication step, but the victim application must connect outbound to an attacker-controlled or interceptable SMTP endpoint, so deployments pinned to fixed, trusted, TLS-authenticated mail servers are substantially harder to exploit. Impact is confined to event-loop blocking and availability loss (no confidentiality or integrity effect), and no public exploit code was identified at time of analysis; the vendor fix is Nodemailer 10.0.13.
A classic buffer overflow (CWE-120) in the SDK service process of Juniper Networks Junos OS lets an unauthenticated attacker on an adjacent network segment crash the process or compromise the Routing Engine by sending specially crafted packets, but only when both the SDK service and a JDAF routing instance are enabled - a non-default configuration. The defect carries a CVSS 4.0 score of 8.7 (assessed as v3.1 AV:A/AC:L/PR:N/UI:N with High confidentiality, integrity, and availability impact), reflecting low-complexity, no-authentication exploitation against feature-enabled devices from an on-link or same-broadcast-domain position. There is no CISA KEV listing and no public exploit identified at time of analysis; Juniper has released fixed maintenance releases, so the practical risk is concentrated on devices running both required features without a patched image.
A stack-based buffer overflow in the l2cpd (Layer 2 Control Protocol daemon) of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated attacker who is Layer 2 adjacent - on the same broadcast domain or directly cabled to the target interface - crash Layer 2 control-plane processing by sending crafted LLDP packets to an interface with LLDP enabled. The primary outcome is denial of service: repeated triggering can destabilize LLDP and other Layer 2 control protocols on the device, though the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, ~6.5) rates this as availability-only impact with no confidentiality or integrity loss. Exploitation is gated by two prerequisites - the attacker must already have local Layer 2 presence and the targeted interface must explicitly have LLDP configured - so remote Internet-based attacks are not possible; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and vendor patches are available.
Stored SQL injection in DataEase versions prior to 2.10.26 allows authenticated users to inject arbitrary SQL into backend queries by storing crafted binning values (FieldGroupDTO.min, .max, .startTime, .endTime) in dataset group-field definitions. The payload is only triggered when a chart that references the tainted field is rendered, giving an attacker with a valid DataEase account high-impact read/write/delete access to the configured backend database (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H). Exploitation requires a low-privileged authenticated account with dataset-editing rights; no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in DataEase's CalciteProvider allows authenticated users with access to a configured datasource to alter the metadata queries the platform builds for getSchema, validate, save, and update flows, executing attacker-controlled SQL against the connected backend database using the application's stored datasource credentials. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.7), reflecting high confidentiality, integrity, and availability impact on the backend database with no victim interaction required, though exploitation is constrained by the need for a valid DataEase account that has been granted datasource access and by the privileges of the application-held datasource account. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released v2.10.27, which introduces identifier quoting, literal escaping, and parameter binding in CalciteProvider.
Regular expression denial of service in GitPython before 3.2.0 allows remote, unauthenticated attackers to exhaust CPU on applications that parse Git commit or tag objects taken from an attacker-controlled repository. The flaw is in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines, which slips into quadratic backtracking when those lines are padded with long space-filled sequences that lack a valid epoch or timezone. Impact is strictly availability (CVSS 4.0 VA:H with VC:N/VI:N) - there is no confidentiality or integrity exposure, so the 8.7 High score reflects CPU exhaustion only, not code execution or data compromise; no public exploit identified at time of analysis.
Improper authentication in the local device-management protocol of TP-Link Kasa smart plugs, switches, dimmers, and bulbs lets an unauthenticated attacker who is already on the same Wi-Fi/LAN segment send management instructions to the device, changing device state and settings or disrupting legitimate user control. The vendor scores this 8.7 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity, and availability impact to the device), and the independent assessment agrees: authentication is not required within the adjacent network (PR:N, CWE-306), but the ADJACENT attack vector confines exploitation to attackers holding a foothold on the local segment rather than the public internet. No public exploit code has been identified at time of analysis, and the described cloud-account information exposure is conditional - it depends on concurrent user, mobile-app, and device-cloud interaction - so full account compromise is not guaranteed.
HTTP request smuggling in Eclipse Vert.x (io.vertx:vertx-core) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, where the HTTP/1.x decoder canonicalizes well-known header names in a way that lets crafted names such as 'Content-Xength' be treated as 'Content-Length'. Unauthenticated remote attackers (CVSS v4.0 vector PR:N/UI:N, score 8.7; independent CVSS v3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) can exploit this to desynchronize how HTTP messages are framed, with integrity impact only and no direct confidentiality or availability loss. Practical impact depends on deployment topology: a second HTTP agent (front-end proxy, load balancer, CDN or back-end server) must share the request path and parse the ambiguous headers differently from Vert.x, whereas a standalone Vert.x HTTP/1.x server with no co-located intermediary sharply limits exploitability; HTTP/2-only deployments are not reached by this decoder path. No public exploit identified at time of analysis, and no confirmed CISA KEV active exploitation.
Authenticated SQL injection in DataEase versions prior to 2.10.26 allows users with dataset-edit permissions to store a crafted custom dateFormat on a dataset field, which is then inserted without validation into date-conversion SQL templates. When a chart renders the affected field, the injected payload can alter generated SQL and potentially compromise the confidentiality, integrity, and availability of the backend database. Reliable exploitation requires a cross-datasource dataset where Calcite parsing is bypassed; on a single-datasource dataset the payload must survive Calcite reserialization as a valid string literal, significantly limiting that path. No public exploit code was identified at the time of analysis, and the vendor has released a patch in version 2.10.26.
Unauthenticated keyboard injection in the FreeRDP shadow server (versions 3.0.0 through 3.31.x) allows remote attackers to send synthetic keystrokes into a host user's X11 session via XTEST by delivering an input PDU during the Confirm Active state, before any authentication takes place. Exploitation requires the shadow/mirroring server to be network-reachable and the host to be running an X11 session over a TLS-only RDP negotiation; the confirmed impact is integrity-only (fabricated input) with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Juniper Junos OS and Junos OS Evolved rpd contain a stack-based buffer overflow that an unauthenticated adjacent LDP peer can trigger with a malformed LDP Label Mapping message, causing an rpd crash or potentially arbitrary code execution. Exploitation requires LDP/MPLS to be configured and the attacker to have an LDP adjacency, so exposure is limited to MPLS-enabled routers rather than arbitrary internet-facing systems. Vendor patches are available; no public exploit code has been identified at time of analysis.
Out-of-bounds read in Eclipse NetX Duo's X.509 certificate parser (routine `_nx_secure_x509_parse_signature_data`) lets a peer that supplies a certificate with an empty ASN.1 BIT STRING signature corrupt the parser's internal signature length to 0xFFFFFFFF and drive a signature pointer one byte past the end of the buffer, producing a crash or destabilization of the device. Because certificates are parsed from the remote peer during the TLS handshake, the issue is network-reachable and unauthenticated - affected devices are those acting as a TLS client toward an attacker-influenced server, or as a TLS server that requests client certificates; the independent assessment rates it AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H). Neither CISA KEV active exploitation nor public exploit code is associated with this CVE at time of analysis, and the principal limiting factor is reachability: only systems that negotiate TLS with untrusted peers are exposed.
OS command injection in @offactory/compress-fonts before 1.1.1 lets an attacker execute arbitrary shell commands with the privileges of the Node.js process by getting a font file with shell metacharacters in its filename into a directory that is being compressed. The supplied CVSS 4.0 vector indicates no authentication is required (PR:N) and high confidentiality, integrity, and availability impact to the vulnerable component, but the attack vector is local (AV:L) and requires a user or automated build to initiate the FontForge conversion (UI:P), so real-world impact is bounded by who can place files in the processed source directory and by the privileges under which the build runs. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor fix is available in version 1.1.1, which replaces execSync with execFileSync.
OS command injection in xhtml2pdf before 0.2.19 lets an attacker execute arbitrary OS commands as the invoking user when the pisa command-line tool is run with the -s/--start-viewer option against a file whose name contains a double quote plus shell metacharacters. The flaw lives in pisa.startViewer(), which interpolates an unescaped filename into os.system('open "%s"'); because the vulnerable path is only reached in viewer-launch mode, the default programmatic HTML-to-PDF conversion API is not affected. The vector is local and requires a user (or job) to actually launch the viewer, and no public exploit code has been identified at time of analysis - confirmed actively exploited status is not present in the available data.
OS command injection in buildebooks (wastemobile) versions before 0.2.2 lets a crafted EPUB file name or project folder name break out of the shell command string built in lib/kindle.js and execute arbitrary operating-system commands with the privileges of the user running the build. Exploitation is local rather than network-reachable: the victim must process an attacker-supplied book project with the Kindle output path enabled (kindle: true), which satisfies the user-interaction prerequisite, and no privileges are needed on the attacker's side per the assessed vector (PR:N). No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, but the affected code path is straightforward (a naive string concatenation into child_process.exec) and a vendor fix is available in 0.2.2.
Code injection in TeamPlus Messenger allows unauthenticated remote attackers to trick a user into interacting with crafted content, injecting and executing arbitrary JavaScript; after the user confirms a Windows security warning, arbitrary code executes with the victim's privileges. The CVSS 4.0 vector scores 8.6 (High) with UI:A, gated by two distinct user actions: interacting with the malicious content and then accepting an OS-level security prompt. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote code execution in TeamPlus Messenger for Windows lets an unauthenticated attacker deliver a crafted link that injects and executes arbitrary JavaScript inside the client, escalating to native code execution with the privileges of the logged-in user once the victim opens the link and confirms a Windows security warning dialog. Rated CVSS 4.0 base 8.6 (High) and mapped to CWE-94, the flaw's practical severity is gated by two mandatory victim actions - following the malicious link and accepting the Windows prompt - so only users who both act are compromised, and execution is confined to user-level privileges rather than SYSTEM or administrative rights. At the time of analysis no public exploit code was identified and the issue was not listed in CISA KEV; only TWCERT/CC advisory references are available, and no vendor patched version is specified in the provided data.
OS command injection in Turnpress through 0.4.2 allows arbitrary shell commands to be executed with the victim user's privileges when the tool's convert or create operation processes a .docx file whose filename contains shell metacharacters. The flaw sits in convertDocxToHtml (src/converter.ts), which invokes pandoc through execa with shell:true, so the crafted filename is interpreted by the shell rather than treated as a literal argument; exploitation is local (AV:L) and requires the victim to run a convert/create command on the malicious file (UI:R), and no privileges are needed to craft the filename. Impact is high for confidentiality, integrity, and availability on the host running the conversion, but it is limited to the invoking user's privileges with no scope change, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; vendor fix is available via an upstream pull request that removes shell:true.
PHP object injection in ILIAS LMS affects installations before 9.24, 10.12, and 11.5, allowing an authenticated user who holds the Test creation or Test import permission to deserialize attacker-controlled objects by importing a crafted Test results archive. By embedding a malicious 'tst_sequence' (sequence) attribute in the archive XML, the attacker reaches an unrestricted unserialize() call and can leverage the bundled Guzzle or Monolog libraries as POP gadget chains to write PHP files and achieve remote code execution on the server. The primary limiting factor is the required authenticated account and import-level permission rather than any anonymous exposure; no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Directive injection in NGINX Gateway Fabric lets an authenticated namespaced tenant escape the auth_basic "<realm>"; quoting rendered into a shared data-plane nginx.conf and inject arbitrary NGINX directives. Exploitation requires a multi-tenant deployment in which several namespaces share one Gateway/data plane, plus namespaced RBAC to create an AuthenticationFilter CRD and attach it via spec.basic.realm or spec.jwt.realm to an HTTPRoute or GRPCRoute bound to that Gateway (CVSS vector shows PR:L and UI:N, so valid authenticated credentials are required and no user interaction is needed). The impact is control-plane only, with no data-plane exposure, but a successful attacker could read co-located tenants' mounted secrets, perform SSRF through proxy_pass, read the pod ServiceAccount token, or hijack other tenants' routes; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Information exposure in the Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, occurs when the provider's API client error-handling path writes sensitive information into an externally accessible file or directory (CWE-209). Dell rates this CVSS 3.1 8.6 (High) with a remote, unauthenticated vector (AV:N/PR:N/UI:N/S:U/C:H/I:L/A:L), but independent assessment maps realistic exploitation to AV:L/AC:L/PR:N/UI:N/C:H/I:N/A:N, because an attacker must already be able to read wherever the provider's error output is persisted - typically shared log aggregation, publicly readable CI/CD output, or exposed Terraform state/debug artifacts - rather than reaching a directly network-exposed service. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor's AV:N vector should be validated against Dell DSA-2026-434 before treating this as a remotely exploitable unauthenticated issue.
Stored cross-site scripting in JTL-Shop lets unauthenticated remote attackers inject arbitrary script code through the shop's public consent endpoint, which accepts and stores attacker-controlled consent names without validating them against configured consent items. Those unvalidated names are then rendered without output encoding on the administration backend's consent statistics page, so the payload executes in the browser session of any administrator who opens that page, allowing actions with the administrator's privileges. No public exploit code or CISA KEV entry was identified at the time of analysis, but the vendor has published a security advisory; the CVSS 4.0 score is 8.6, and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) confirms an unauthenticated, remote, high-impact issue whose successful exploitation depends on an administrator passively viewing the affected statistics page.
SmsForwarder through 3.5.0 exposes an AndServer-based HTTP remote-control interface whose API endpoints are enabled by default and perform no authentication check, allowing anyone who can reach the device's listener on an adjacent network to read SMS messages, call logs and contacts, send SMS on the victim's behalf, and export or overwrite the app's configuration via the clone API. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) and the independent assessment agree that exploitation is unauthenticated and requires no user interaction, but is constrained to an adjacent network path such as the same LAN or Wi-Fi segment rather than arbitrary internet reachability. The vulnerability is not listed in CISA KEV and no public exploit code was identified at time of analysis; no EPSS score, no vendor CVSS 3.1 vector, and no explicit POC flag were provided, so those prioritization signals remain unknown rather than assumed.
Heap out-of-bounds read and write in the DPDK Generic Segmentation Offload (rte_gso) library can be triggered when an application enables GSO on its packet path and is configured with small or undersized mbuf pools relative to the segmentation workload, letting network-delivered traffic corrupt memory in the data plane. The vendor-published CVSS 3.1 base score is 8.6 (High) on a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, indicating a network-reachable, unauthenticated, low-complexity heap out-of-bounds read/write; our independent assessment keeps the network-reachable, unauthenticated profile but assesses higher attack complexity (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) because exploitation is gated on the non-default-looking small-mbuf-pool configuration together with GSO actually being enabled. Impact is dominated by availability (A:H), so the realistic outcome is a data-plane crash rather than full host compromise, with only partial confidentiality and integrity effects; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Eclipse Vert.x Web versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 contain a scope bypass in ChainAuthHandler that allows an authenticated remote attacker with a valid token but insufficient scopes to access resources protected by withScope() or withScopes() requirements. The flaw occurs when a preceding authentication handler in the request pipeline has already authenticated the user, causing ChainAuthHandler to skip scope validation in both any() and all() modes; the most common trigger is overlapping authentication handlers on nested routes. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Better Auth SSO (@better-auth/sso) 1.7.0-rc.2 through 1.7.2 allows an authenticated low-privilege user to sign in as other users by registering a personal SSO provider that copies a legitimate provider's OIDC issuer or SAML entity ID and asserts a victim's subject or NameID; the account lookup ignores providerId, so the forged personal provider can create a session for the victim account. Exploitation requires a valid account and that the application permits user-registerable personal SSO providers, and no public exploit has been identified at time of analysis. The issue is fixed in 1.7.3; CVSS 8.6 reflects high confidentiality and integrity impact.
Unauthenticated attackers who can reach the Ubiquiti UniFi Protect AI Key over the network can abuse an improper access control weakness to read information from the device, make unauthorized changes, and knock it offline. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, base 8.6) confirms the attack requires no credentials and no user interaction, with the dominant impact being a high-availability Denial of Service and limited confidentiality and integrity effects. No public exploit code was identified and there is no CISA KEV listing at time of analysis; Ubiquiti's Security Advisory Bulletin 070 is the authoritative source for affected firmware and fixes.
OS command injection in the Junos OS CLI lets an authenticated, low-privileged local user escalate to full root control of the device by passing unsanitized arguments to the 'request csds' operational command. Only Junos OS 24.4 (from 24.4R1 up to before 24.4R2-S4), 25.2 (before 25.2R2-S1), and 25.4 (before 25.4R1-S3) are affected; releases before 24.4R1 are explicitly unaffected, and the attack is strictly local with no network or unauthenticated path. There is no public exploit identified at time of analysis, and Juniper has released fixed versions (24.4R2-S4, 25.2R2-S1, 25.4R1-S3), making this a serious but access-gated issue rather than an internet-facing emergency.
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
Improper validation of the JWT seeding token used by Akamai's Guardicore Platform Agent (GPA) client before version 7.4 allows an attacker who persuades a user to interact with a crafted link to slip a spoofed token into the enrollment flow and inject arbitrary configuration parameters, reconfiguring the agent and compromising its functionality end to end. The same spoofed-token technique can be aimed at an already-seeded client, but only when the attacker also knows the specific identity-provider (IDP) URL that client used for enrollment, a concrete prerequisite that constrains opportunistic targeting. There is no public exploit code identified at time of analysis and the issue is not in CISA's KEV catalog; Akamai has released 7.4 as the corrected version, and the independent assessment rates the flaw CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - serious, but not an immediate drop-everything emergency on current signals.
Remote code execution in Markdown Preview Enhanced (a Visual Studio Code Markdown preview extension) before 0.8.29 lets a malicious repository run operating-system commands as the victim's account the moment the victim opens a Markdown file from that repository. The extension automatically evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files through vm.runInNewContext, and prototype-chain traversal escapes the Node.js host realm to reach the Function constructor and the process object - no further interaction and no module-scoped require are needed, and both the configuration-evaluation and parser-hook paths are affected. The vector requires local placement of the repository plus user interaction (opening the file), so it is not mass-exploitable over the network against a default install; there is no CISA KEV listing and no public exploit identified at time of analysis. The issue is fixed in Markdown Preview Enhanced 0.8.29, which bundles crossnote 0.9.30.
Blind SQL injection in the Webnus Modern Events Calendar Lite plugin for WordPress (versions before 7.37.0) lets an authenticated low-privilege user inject SQL through a plugin endpoint that fails to neutralize special elements, allowing them to read arbitrary data from the site's database. The provided vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) requires a valid low-privileged account, so sites that restrict registration or grant only minimal roles present a materially higher barrier; our independent assessment keeps the high confidentiality impact but scores scope as unchanged (S:U) and shifts the integrity/availability impact to a low integrity impact, which lowers the practical blast radius claimed by the vendor vector. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Authenticated SQL injection in the Codepeople CP Multi View Event Calendar WordPress plugin (versions through 1.4.41) allows a logged-in user with low-level privileges to feed crafted input into an unsanitized database query, giving the attacker read access to data held in the site's WordPress database and potential limited manipulation of it. Patchstack rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, CWE-89), and exploitation is contingent on the plugin being installed and active plus a valid account on the site - fully anonymous visitors cannot trigger it, and no public exploit code has been identified at time of analysis.
Server-side request forgery in Renovate before 44.79.0 allows authenticated users with low privileges to direct the shared HTTP client at arbitrary internal URLs through 'extends' preset references or 'customDatasources' entries. An attacker who can influence Renovate's configuration - for example by committing to a scanned repository or controlling a preset source - can reach an instance metadata endpoint such as AWS IMDS to obtain credentials, or exfiltrate sensitive information into Renovate logs; real-world impact depends on the deployment's network reachability of internal services. The vendor fixed the issue in Renovate 44.79.0, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in GStreamer's gst-plugins-base plugin library lets a local attacker who controls the sending side of a GStreamer inter-process IPC pipeline corrupt memory in the receiving process, yielding a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. The victim process maps a crafted video buffer whose GstVideoMeta declares plane strides and offsets larger than the actual backing allocation, causing out-of-bounds reads and writes that can crash the process or potentially permit code execution in its context. Exploitation is strictly local and requires a deployment where GStreamer buffers cross a trust boundary between a less-trusted producer and a more-trusted consumer; no user interaction or authentication to the victim is needed, and no public exploit has been identified at time of analysis.
Heap out-of-bounds write in Eclipse ThreadX GUIX's binary theme resource loader (gx_binres_theme_load) lets a crafted binary resource (theme) file overwrite memory past the end of the loader's own arena with bytes taken verbatim from the file, producing high confidentiality, integrity, and availability impact on the affected process. The vector is local rather than network-reachable: an attacker must get the malformed theme file onto the device and the target application must actively load it (CVSS 4.0 AV:L/UI:A; assessed CVSS 3.1 AV:L/UI:R, PR:N, so no privileges are needed once the file is loaded), and deployments that only load theme resources compiled into firmware, or that never accept externally sourced theme files, are not exposed. GX_BINARY_RESOURCE_SUPPORT is enabled in the shipped default configuration, so no special build option is required for the flaw to be reachable; no public exploit code was identified at time of analysis, and no caller-side workaround is possible because the public API takes no buffer-size parameter.
Missing authorization in holaOS channel-gateway connectors (Telegram, Slack, Discord, and similar) through 2026.822.1 allows any unauthenticated messaging-platform user who can reach an operator's configured bot to submit agent tasks, because the #isAllowed check treats an empty default allowFrom list as permitting all senders and ChannelIngress.handle then forwards those turns to the workspace agent, which executes configured tools on the operator's machine. Exploitation requires the connector to be configured and allowFrom left at its empty default (attack requirements present, AT:P) and needs no user interaction; no public exploit code is identified at time of analysis, but the CVSS 4.0 base score of 8.3 reflects high integrity impact (VI:H) with low confidentiality and availability impact. This is a high-priority issue for operators who actually run holaOS with a chat connector and have not populated an explicit sender allowlist.