Command injection in Ubiquiti's UniFi Protect AI Key lets a network-reachable, unauthenticated attacker (CVSS PR:N/UI:N) potentially execute arbitrary operating-system commands on the appliance, giving full loss of confidentiality, integrity, and availability. Per the supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), exploitation is high-complexity: the vendor conditions success on unspecified preconditions ('under certain conditions'), so attacks are not expected to succeed against every deployment and require the attacker to reach the device's network and satisfy environment-specific state. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was provided; the practical exposure is dominated by whether the AI Key is reachable from untrusted network segments.
Canonicalization inconsistency in the NGINX JavaScript (njs) XML module lets an unauthenticated attacker who already holds a genuinely signed SAML/XML document cause entity-backed attributes to appear absent or truncated ($attr$Name returning undefined, $attrs derived from only the first attribute child) while signature verification still succeeds. nginx-saml running the built-in njs backend is the confirmed affected consumer, where this can bypass expiry, Destination, and request-correlation checks and enable replay or acceptance of a response outside its intended context; the flaw cannot forge signatures or identities and has no availability or control-plane impact. F5's advisory rates this 8.3 (High, CVSS 4.0 with AT:P reflecting the significant effort needed to obtain a validly signed document); no public exploit code was identified at time of analysis, and no KEV listing applies. There is no public exploit identified at time of analysis.
SSL session ticket key handling in NGINX Plus and NGINX Open Source can let a remote unauthenticated attacker forge client SSL sessions and bypass client certificate verification, but only on instances that enforce mutual TLS and rely on NGINX's automatic ticket key rotation. Exploitation is conditional and non-deterministic: the affected deployments must be configured with ssl_session_cache shared:name:size and must not set an explicit ssl_session_ticket_key file, and the resulting forgery is beyond the attacker's control (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, 6.5). There is confirmed data-plane information exposure potential but no control-plane exposure, and no public exploit identified at time of analysis.
Unauthenticated local file inclusion in the Mang Board WordPress plugin (all versions through 2.4.3) allows remote attackers to include and execute arbitrary PHP files by supplying a crafted '<mode>_type' parameter (e.g. foo_type) to any publicly reachable page that renders the [mb_board] shortcode. Because no nonce or capability check is enforced on the shortcode render path, the LFI itself is trivially triggered by an unauthenticated POST and can be used to bypass access controls or disclose sensitive data; full code execution is a further step that requires either a standard PHP installation exposing pearcmd.php (which can be abused to write and then include an attacker-controlled payload in a single request) or the ability to upload .php files that are then included, which is why the vendor scored the issue AC:H despite the unauthenticated PR:N vector. The vulnerability is tracked as CWE-98 with a CVSS 3.1 base score of 8.1, reported by Wordfence; no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, though the low exploitation complexity warrants prompt patching.
Unauthenticated local file inclusion in ShopMagic for WooCommerce (all versions up to and including 4.9.0) allows remote attackers to include and execute arbitrary .php files on a WordPress server by submitting a path payload as the billing first name during WooCommerce guest checkout. The value reaches the plugin's PHP template renderer through the {{ customer.first_name }} placeholder, and the built-in "New Order email with social media profile links" recipe processes that placeholder out of the box, so default configurations are exploitable with no account, cookie, or nonce. CVSS is 8.1 (C:H/I:H/A:H, AC:H); full code execution additionally requires that an attacker-controllable .php file already exist on the server, and no public exploit code was identified at time of analysis. The vendor-released fix is 4.9.1.
Denial of service in the Erlang OTP ssl application allows a malicious or man-in-the-middle TLS 1.3 server to crash the node-global session-ticket store on a connecting client, and repeated crashes can exhaust the ssl supervisor restart intensity and take down TLS for every connection on that node. The victim must be a TLS 1.3 client running OTP 23.3 through the fixed releases with session_tickets set to auto (automatic ticket storage and resumption); the crash does not occur when the bogus ticket is received but on the next automatic resumption attempt, and it requires the client to initiate the outbound connection, which is reflected in the assessed AT:P attack-requirement metric and a CVSS 3.1 base of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) despite the vendor's CVSS 4.0 score of 8.2. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but vendor patches and upstream commits are available. Reported by the Erlang Ecosystem Foundation (EEF) and tracked as EUVD-2026-101384.
InvoiceShelf installs prior to 2.4.0 leak other customers' invoices, estimates, and payment PDFs through the public customer-portal token routes, because the EmailLog token is resolved by numeric mailable_id without checking mailable_type and the JSON handlers never enforce EmailLog::isExpired. An unauthenticated remote attacker holding any legitimate emailed customer link (PR:N, no account needed) can therefore retrieve a document belonging to a different company when numeric identifiers collide across tenants, or keep using an already-expired link indefinitely on the JSON routes GET /customer/invoices/{email_log:token}, GET /customer/estimates/{email_log:token}, and GET /customer/payments/{email_log:token}; the view handlers can additionally flip a mismatched invoice or estimate to 'viewed' and trigger a notification email. Rated CVSS 8.2 (C:H, I:L) as a genuine improper-authorization flaw (CWE-285), though the cross-tenant variant is opportunistic and gated by id collisions while the expired-token variant is fully reliable; no public exploit code has been identified at time of analysis and the issue is fixed in version 2.4.0.
Unauthenticated network attackers can cause a complete denial-of-service (FPC crash) in Juniper Junos OS on SRX Series by exploiting a NULL pointer dereference in the DNS plugin when multiple DNS queries in a single flow session trigger both Security Intelligence (SecIntel) feed matching and Domain Generation Algorithm (DGA) analysis. Exploitation requires a non-default configuration where both SecIntel and DGA features are enabled, and the crash depends on a timing/race condition that the attacker cannot directly control, limiting reliability. No public exploit code has been identified at time of analysis, and vendor patches are available.
Unauthenticated local file inclusion in the BP Profile Search plugin for WordPress (versions up to and including 5.9) lets an attacker force the site to include an arbitrary PHP file by supplying an 'ajax_template' value inside the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. No authentication or special configuration is required, and the plugin performs no basename restriction, whitelist, or path-traversal validation before appending '.php' and passing the value to bp_locate_template(); escalation to full remote code execution is conditional on an includable PHP file already existing on the server (for example via a separate file-upload weakness or default container images such as wordpress:php8), while without such a file the attacker is limited to including existing server-side PHP, which still risks information disclosure and unintended code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1), with the High attack-complexity reflecting the RCE precondition.
Unauthenticated arbitrary file read in the dbt docs serve component (dbt 2.0.0-alpha.0 through 2.0.0-alpha.4) lets any client that can reach the server POST attacker-chosen SQL to /api/v1/query and invoke DuckDB filesystem-reading functions, returning the contents of files readable by the dbt process - including paths outside the docs index directory. The SQL handler was removed entirely in 2.0.0-alpha.5. Reachability is the gating prerequisite: dbt docs serve binds to localhost by default, so remote exploitation only succeeds when an operator has exposed it via the host option or the DBT_DOCS_HOST environment variable; no public exploit code was identified at time of analysis, and no KEV listing is associated with this issue. The vector is unauthenticated (PR:N) with high confidentiality impact only (VI:N, VA:N), giving a 4.0 base score of 8.2 and an assessed 3.1 score of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
A network-based, unauthenticated attacker can cause a temporary denial of service on Juniper Networks SRX Series devices running Junos OS when the SSL proxy feature is enabled. During a TLS session-resumption attempt, a specifically malformed TLS message triggers an improper handling of a missing special element in the SSL plugin, leading to an invalid pointer access and a Packet Forwarding Engine (PFE) crash that interrupts traffic forwarding until the PFE automatically recovers. Exploitation is conditional: it requires the non-default 'ssl-proxy' configuration, and the exact internal timing needed to hit the fault is outside the attacker's direct control, making the attack probabilistic rather than reliably repeatable; no public exploit identified at time of analysis and there is no impact to confidentiality or integrity, only availability. Vendor-released patches are available in the fixed Junos OS releases listed in advisory JSA112176.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
Denial of service in Juniper Networks Junos OS on SRX Series firewalls with UTM WebFiltering enabled allows unauthenticated, network-based attackers to crash and restart the UTM subsystem, knocking out all UTM-served traffic until the device recovers. The crash is not directly reachable: it requires the external WebFiltering cloud categorization server to be unreachable so that category-lookup requests accumulate, plus sustained HTTP load and a specific timing window during cleanup of those pending lookups that drives the process into an invalid internal state (CWE-413, improper resource locking); both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF) are affected. Junos OS 23.2R2, 23.4R2, 24.2, 24.4, 25.2 and 25.4 branches are impacted below their respective fixed releases, the vendor rates this CVSS 4.0 base 8.2, and no public exploit identified at time of analysis. Because of the cloud-server-unreachable precondition and the load/timing race, the independent assessment classifies this as a genuine availability risk rather than a drop-everything emergency.
Remote, unauthenticated requests to HPE NonStop iTP WebServer can trigger memory corruption severe enough to shut the service and system down, giving network-positioned attackers a reliable denial-of-service with a secondary integrity impact. The assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, CVSS 8.2) shows no authentication, user interaction, or non-default feature is required - the only real barrier is that the target web server must be network-reachable, and it runs solely on the niche HPE NonStop platform rather than commodity servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied; combined with the narrow platform footprint, this is a genuine but bounded priority rather than a mass-exploitation threat.
File overwrite in FileRise prior to 3.18.0 allows an unauthenticated visitor who holds a valid upload-enabled shared-folder or upload-only link token - plus any configured share password - to re-upload a file using the exact name of an existing file and silently replace its contents while the original uploader metadata is preserved. The same missing replacement check affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the target file, so the outcome is a high-integrity, no-confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, 8.2). Exploitation requires that an administrator has actually created and shared an upload-capable link and that the attacker knows or guesses the target filename; impact is confined to overwriting existing files, with no data disclosure and no code execution path. No public exploit code was identified at time of analysis, and the vendor-released fix is FileRise 3.18.0.
Memory exhaustion and limited configuration-resource disclosure affect OmniFaces (maven/org.omnifaces:omnifaces) before 1.14.3, 2.7.33, 3.14.23, 4.7.12 and 5.4.2 because CombinedResourceHandler accepts a structurally valid deflated, base64-encoded combined-resource ID without verifying the server issued it. A remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 8.2) who reaches a JSF application that has opted into the resource-combining handler can inflate a forged ID with roughly 770:1 amplification (about 20 KB input expanding to ~16 million characters, ~49 MB heap delta), add unique reconstructed IDs to a process-lifetime cache with no eviction, and read Facelets source from the webapp resource tree or META-INF/resources because jakarta.faces.RESOURCE_EXCLUDES is not applied on this custom resolution path. The advisory documents in-lab reproductions of these behaviors (including a blind, deployment-dependent server-side fetch when the non-default wildcard CDN mapping and an omnifaces.graphic inner resource are in play), but this is not confirmed as actively exploited and is not listed in CISA KEV; no public exploit code was identified at time of analysis.
Denial of service in Nodemailer 3.0.0 through 10.0.9 allows an attacker-controlled or on-path SMTP server to stall a Node.js application by streaming SMTP continuation lines that never deliver a terminating completion line during the greeting/authentication phase. The vulnerable reply parser in SMTPConnection._onData and isPartialResponse re-evaluates its buffered response on every incoming chunk, so parsing cost grows quadratically with the size of the accumulated reply, blocking the single-threaded event loop and consuming memory before authentication completes. No public exploit code was identified at time of analysis, and exploitation is conditional: the client must be configured to connect to an untrusted or attacker-influenceable SMTP server, or an attacker must be positioned on-path on an interceptable SMTP connection, which is why the assessed vector carries AC:H and AT:P and this is a genuine but conditional availability risk rather than a blanket critical one.
Unauthenticated remote attackers can exhaust disk space on n8n deployments before 2.41.4 and 2.42.x before 2.42.1 by abusing the OAuth authorize endpoint to create unlimited first-party OAuth client records, bypassing the registration cap. The flaw arises because the endpoint resolves clients by URL path but stores the caller's raw identifier as the record key, so identifiers differing only in their query string are treated as new clients and persisted indefinitely. Impact is availability-only (disk exhaustion); the independent assessment rates this a genuine but non-emergency availability risk, since sustained request volume is required and exposure depends on whether the OAuth endpoint is reachable. No public exploit identified at time of analysis.
Unauthenticated remote attackers can terminate the Parse Server process by driving the email verification or password-reset flow while the configured mail provider rejects, rate-limits, or is unavailable - a state an attacker can force by rapidly issuing requests until the provider throttles. Only public application keys are required (no user account), and affected deployments are Parse Server before 8.6.97 and the 9.0.0 line before 9.10.2-alpha.6, with the server's email features enabled. The underlying defect is an uncaught exception (CWE-248) raised on a failed send that aborts the Node.js process, so a single rejected message produces a full service outage; no public exploit identified at time of analysis, and deployments with email flows disabled are unaffected.
Missing authorization in the Skydropx WordPress plugin (versions through 2.1.4) allows unauthenticated remote attackers to bypass access controls, potentially disclosing sensitive data with high confidentiality impact and limited integrity impact. The flaw is remotely exploitable with low complexity and requires no privileges or user interaction. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Unbounded heap accumulation in the FreeRDP proxy (the pf/proxy relay component) lets unauthenticated remote attackers exhaust proxy memory by streaming RDPDR device-redirection fragments that begin with a FIRST fragment but never carry a LAST fragment, so reassembly state grows in proportion to bytes sent. Affected deployments are FreeRDP 3.0.0-beta1 through versions before 3.32.0 that run the proxy with the RDPDR channel reachable from untrusted clients; plain FreeRDP client or server deployments are not the stated target. Rated CVSS 4.0 8.2 (High), with assessed CVSS 3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, this is a slow-burn memory-exhaustion DoS requiring sustained fragment traffic rather than a single packet, and there is no public exploit identified at time of analysis.
Client termination in FreeRDP before 3.32.0 occurs when a malicious RDP server sends repeated serial IRP_MJ_CREATE requests, causing the client to accumulate file descriptors until it hits the CommReadFile FD_SETSIZE assertion and crashes. The flaw requires the non-default serial/COM port redirection channel to be active and the victim to connect to an attacker-controlled or compromised server; it is an unauthenticated remote denial of service with no code execution or data exposure. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated access-control failure in OpenAEV prior to 2.260622.0 allows anyone who knows a valid exercise UUID to read lessons-learned questions and answers - including the identity of each answer's author - and to create or overwrite answers attributed to an arbitrary user. The flaw affects default installations of the adversary-simulation platform and is remotely exploitable without credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base score 8.2), making it a high-priority exposure for unpatched instances; the sole prerequisite is possession or guessing of an exercise UUID, and no public exploit code has been identified at time of analysis.
Unauthenticated attackers can bypass signature verification in FlexPrice's QuickBooks webhook handler (HandleQuickBooksWebhook) through version 2.1.38 by omitting the intuit-signature header, enabling forged payment notifications that can mark invoices paid or overpaid. Exploitation requires knowledge of a valid tenant and environment ID and an active, network-reachable QuickBooks integration; deployments not using QuickBooks webhooks are unaffected. No public exploit identified at time of analysis, though a public technical write-up is available, and this is a credible, moderate-to-high integrity risk.
Buffer overflow in the DPDK vhost-user backend's split-ring inflight descriptor table handling allows a guest VM with code execution to corrupt host memory, potentially leading to code execution on the host. This high-severity flaw (CVSS 8.8) is the most critical issue in a bundled DPDK security advisory and affects multi-tenant deployments where the split-ring inflight feature-used for vhost-user reconnection and live migration-is enabled. No public exploit code has been identified at the time of analysis.
Integer overflow in NASA's F´ (F Prime) Svc::FileUplink component allows an operator with command-link access to bypass the declared upload-size check and write file data beyond the intended boundary, corrupting file integrity and enabling large sparse-file growth or storage/resource exhaustion. The flaw affects releases prior to 4.2.0 and is reachable by any attacker who can deliver a crafted DATA packet carrying a byteOffset and dataSize whose unsigned U32 sum wraps below the declared file size; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) reflects network reachability, low complexity, low privileges, no user interaction, high integrity and availability impact, and no confidentiality impact. No public exploit identified at time of analysis, and there is no confirmed active exploitation (not listed in CISA KEV); the vendor-released fix is version 4.2.0.
Authorization bypass in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 8.10.2.1) lets any authenticated user with subscriber-level access or higher delete arbitrary business directory listings, including listings owned by other users and posts in publish, draft, or private status, without any ownership or capability check. Scored 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), it is remotely reachable by an authenticated attacker (PR:L) with no user interaction and no confidentiality impact, but a high integrity and availability cost from destroyed content. The nonces that nominally guard the endpoint (directorist_nonce and atbdp_nonce_js) are exposed to every logged-in user through wp_localize_script, so they function as CSRF tokens only and are not an authorization barrier; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV). Practical exposure is greatest on public directory and classified-ad sites that permit open registration, since any visitor can self-register at subscriber level and then delete listings en masse.
Denial of service in HPE NonStop DNS 9.2.3 (Non Secure Version) lets an unauthenticated remote attacker disrupt the DNS service on affected NonStop systems by supplying crafted input that the service misinterprets. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (base 8.2) confirms network reachability, low attack complexity, no authentication and no user interaction, with a high availability impact, minor integrity impact and no confidentiality impact. Exposure is narrow - only HPE NonStop installations running this specific 'Non Secure Version' DNS component are affected, and reachability of the DNS listener determines real-world risk; no public exploit code identified at time of analysis and no confirmed active exploitation.
Authentication bypass in FileRise (CWE-290) lets unauthenticated remote attackers impersonate any account - including an administrator - without a password or MFA in deployments prior to 3.16.0 that enable proxy-header authentication (AUTH_BYPASS) and expose the backend port directly. The flaw is that the configured reverse-proxy identity header (X-Remote-User) was trusted without validating that the request actually came from an address in FR_TRUSTED_PROXIES; an attacker who can reach the backend application port therefore simply supplies the header and receives a session for the named account. Exploitation requires proxy-header auth to be enabled, the trusted-proxy check to be absent or ineffective (exactly what 3.16.0 fixes), and a network path to the backend that bypasses the proxy, which is why it is scored AV:N/AC:H/PR:N/UI:N with full confidentiality, integrity, and availability impact (CVSS 3.1: 8.1 High); no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Arbitrary filesystem write in Ludwig versions prior to 0.17.8: the dataset archive extraction routine (ludwig.datasets.archives.extract_archive) validates tar member names but never validates symlink or hard-link members, so a crafted archive can create a link that escapes the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary path with the extracting process's privileges. The same name check relied on os.path.commonprefix, a character-based comparison that also lets a sibling path sharing the destination's character prefix pass. Exploitation requires the victim to load a dataset whose configured archive URL points at an attacker-controlled or attacker-compromised tar file (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - unauthenticated from the network, but mandatory user interaction), and is limited to Python 3.12 and 3.13 runtimes because Python 3.14's default tar 'data' filter already rejects escaping links; no public exploit code or confirmed active exploitation was identified at time of analysis.
Online second-factor guessing against FileRise releases prior to 3.23.0 is permitted well beyond the intended limit because failed TOTP verification attempts are recorded only in the PHP session rather than in a durable account-wide budget. An attacker who already possesses a valid primary credential (username plus password) for an account with TOTP enabled can abandon the pending login, start a fresh session, or change source address to restore the five-attempt allowance and continue guessing time-based codes indefinitely. Exploitation therefore has a hard precondition - the primary credential - and each guess remains a probabilistic online attempt against a rotating code, but a successful guess yields full account compromise; the vendor addressed the flaw in v3.23.0 and no public exploit code has been identified at time of analysis.
Authenticated remote attackers who know a published project's public DeployBoard anchor can exploit an authorization bypass in Plane 1.3.1 and earlier to create or soft-delete file assets in any workspace project without being a member, leading to cross-workspace file injection, storage abuse, and data loss. The flaw is an IDOR (CWE-639) with a CVSS 8.1 rating (integrity and availability high, confidentiality none). No public exploit code identified at time of analysis; the issue is fixed in Plane 1.4.0.
Multi-factor authentication bypass in FileRise WebDAV prior to 3.16.0 allows an attacker who already holds a valid username and password for a TOTP-enabled account to authenticate to the WebDAV endpoint without supplying the second factor, then operate within that account's WebDAV file permissions. The weakness is conditionally gated: the opt-in WebDAV service must have been enabled by an administrator, the targeted account must have TOTP configured, and the attacker must already know the account's primary credentials, which the CVSS vector reflects as authenticated access (PR:L); the normal browser login path was never affected. Rated CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with high confidentiality and integrity impact and no availability impact; no public exploit code or active exploitation was identified at time of analysis. The issue is fixed in FileRise 3.16.0.
Session hijacking in WeGIA prior to 3.8.6 lets an unauthenticated remote attacker fix a victim's PHP session identifier and later reuse it as the victim's authenticated session. The auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID value into a Set-Cookie response and sets the cookie Domain attribute to DB_HOST, so the same handler also leaks the internal database hostname to any visitor. Exploitation is conditional on victim interaction: the victim must log in while carrying the attacker-chosen identifier, and no public exploit code was identified at time of analysis; upgrading to 3.8.6 removes the flaw.
Insecure direct object reference in ServiceNext's /api/Usuario/GetUsuarios endpoint lets any authenticated user enumerate and retrieve the complete profile record of every other account - including passwords stored in cleartext - simply by iterating the numeric ID submitted in the request body, which enables account takeover and credential-stuffing. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw requires only a valid low-privileged token, no administrative role, no user interaction, and no non-default configuration, so exploitation works against default installations of the affected SerTec/ServiceNext 1.00 release. No public exploit code and no CISA KEV entry were identified at time of analysis, though the low complexity and the cleartext credential storage make the issue operationally severe once any account is obtained.
Out-of-bounds kernel memory reads in the Linux kernel's in-tree SMB/CIFS client (cifs.ko) occur when parse_posix_sids() trusts a server-supplied out_len instead of validating it against the actual length of the received iov, so an inflated length makes sidsbuf_end point past the buffer and defeats the bounds guards in posix_info_sid_size(). The flaw affects kernels from the 6.6.32 baseline through the fixed releases 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4; unauthenticated remote attackers (CVSS PR:N) can trigger it, but only after the client is induced to mount or connect to an attacker-controlled or compromised SMB server (UI:R), which limits unsolicited exposure. Impact is high on confidentiality and availability (C:H/A:H) via leaked adjacent kernel memory and potential crashes; there is no public exploit identified at time of analysis, no KEV listing, and EPSS is low at 0.21% (10th percentile), giving a this_week remediation signal rather than an emergency.
Authentication bypass in FileRise versions before 3.23.0 lets a remote attacker log in as an existing local account - including the built-in administrator - by presenting OIDC claims whose mutable preferred_username value, or an unverified email, collides with that account's local username; the flaw works even when OIDC automatic provisioning is disabled. Successful takeover yields full read, write, and delete control over the file manager and its stored files, consistent with the assessed CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is conditional, not universal: the deployment must be configured for OIDC SSO and the identity provider must allow the colliding claim or omit email_verified, which is what drives the High attack-complexity rating; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vulnerability is fixed in FileRise 3.23.0.
A crafted DOS (MBR) extended-partition image can trigger a 32-bit integer overflow in util-linux's libblkid partition parser before version 2.41.4, causing the library to report a bogus partition that overlaps the master boot record. An unprivileged local attacker only needs to get a malicious disk image or removable medium in front of a probing path - such as automatic udev/udisks inspection of an inserted USB device, or any tool, VM, or forensic pipeline that scans attacker-supplied images - and no public exploit code or confirmed active exploitation has been identified at time of analysis. The realistic impact is limited: libblkid's reported partition metadata is falsified (an integrity issue), while actual disk modification or availability loss would require a separate downstream consumer to trust and act on that incorrect metadata, so the practical risk is modest despite a higher CVSS base score in some feeds.
Local privilege escalation in Nix (before 2.35.3) and Lix (before 2.95.4) allows an unprivileged local user to escalate to the privileged nix-daemon account-typically root-by exploiting a repair operation that destroys and replaces a store path before verifying its content. The flaw is a timing-sensitive incorrect behavior order (CWE-696) that only affects multi-user daemon deployments; single-user installs are far less exposed. No public exploit code has been identified at time of analysis.
Insecure deserialization of untrusted data in HPE NonStop Middleware (CWE-502), combined with weak handling of secret keys, allows an attacker who already holds high privileges on the middleware to submit crafted serialized content and achieve high impact to integrity and availability, with the effect capable of crossing into other security scopes (CVSS 7.9, S:C). The attack is network-reachable but sharply constrained: it requires high privileges (PR:H) and high attack complexity (AC:H), meaning the attacker must defeat the secret-key protection or hit a narrow configuration/state rather than walk a default path, and no user interaction is needed (UI:N). The realistic attacker population is therefore insiders or actors who have already compromised privileged NonStop credentials; no public exploit identified at time of analysis.
Hitachi Disk Array Driver for AIX (01-00 before 01-23-/A) and for Virtual I/O Server (01-04 before 01-23-/A) mishandle temporary files (CWE-377), allowing a locally authenticated attacker to pre-create or symlink a predictable temp file path and redirect a higher-privileged driver operation, yielding high integrity and availability impact with an assessed scope change (S:C) and a vendor CVSS of 7.9. Exploitation is strictly local (AV:L) and requires user interaction (UI:R) - a privileged user or process must trigger the driver operation while the attacker wins the race - so no public exploit has been identified at time of analysis and there is no KEV/active-exploitation signal. The practical risk is a local privilege-escalation-style attack against AIX and VIOS hosts with the affected driver installed, degrading to tampering/availability loss rather than confidentiality exposure (C:N).
Arbitrary file write outside the intended extraction directory is possible in BusyBox's dpkg-deb applet because its ar archive handler flushes deferred symlinks after every archive member rather than once after the final member. A crafted .deb containing two data.tar members - the first declaring a symlink to an absolute path such as '/', the second declaring a regular file whose path traverses that now-live link - causes a file to be written at an attacker-chosen location when the package is unpacked (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-59). Affected systems are BusyBox builds compiled with dpkg-deb support, including BusyBox shipped inside Red Hat Hardened Images; the CVSS vector indicates no privileges are required by the attacker (PR:N) but the victim must interact by extracting the untrusted package, and the vector's local attack value plus the non-trivial two-member structure keep this a context-dependent integrity issue rather than a mass-exploitation emergency. No public exploit identified at time of analysis.
mise (a polyglot dev tool manager for node, python, cmake, terraform, and others) before version 2026.7.14 lets a malicious local project inject interpreter arguments through an untrusted .mise.toml [settings] file, causing attacker-chosen commands to execute with the developer's privileges. In default non-safe mode, mise applies local project settings before trust approval, and the unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, and windows_default_inline_shell_args fields were missing the global_only marker, so they survived strip_local_only_settings. When a developer later runs a trusted task, postinstall directive, template exec, or hook that has no explicit shell, mise appends the legitimate command after the attacker-controlled interpreter arguments, and the attacker's command runs first despite the config never being trusted. Exploitation is local and requires user interaction (the victim must clone/open and run the affected task); there is no public exploit code and no confirmed active exploitation at time of analysis, and this is best characterized as a conditional local-escalation risk rather than a mass-exploitation threat. Fixed in 2026.7.14.
Heap buffer overflow in DPDK's lib/vhost VDUSE control-queue handler allows a local, low-privileged (authenticated) actor to corrupt heap memory with attacker-controlled content, enabling privilege escalation and loss of host integrity. The root cause is a time-of-check-to-time-of-failure (TOCTOU) double-fetch: the control-queue descriptor is read twice from memory the attacker can modify in between, so the length used for the copy can differ from the length that was validated. Only deployments that actually exercise the VDUSE (vDPA Device in Userspace) control-queue path are exposed, and because winning the race is probabilistic the CVSS base score of 7.8 (AV:L/AC:L/PR:L) is more realistically an AC:H scenario per our assessment; no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine privilege-escalation and host-integrity concern rather than a mass-exploitation threat, since it is strictly local, involves no remote network path, and requires controlling the descriptor memory between fetches.
Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.
Kaneo project-management installations before 2.1.6 fail to enforce workspace membership on API routes in the task, label, activity, and search modules, so an authenticated user with a valid account on the instance can read, modify, or delete projects, tasks, labels, and comments belonging to other workspaces by simply supplying a foreign project, task, label, or workspace identifier. Exploitation requires both a legitimate authenticated account (CVSS PR:L) and knowledge of valid identifiers from another tenant, which per the source advisory can be harvested out-of-band from shared project links; no user interaction is needed and the flaw is network reachable. Impact is bounded to confidentiality, integrity, and availability of workspace data within the affected instance, and no public exploit code was identified at time of analysis. Multi-tenant or multi-workspace deployments face materially higher exposure than single-workspace instances, and the vendor-released patch is version 2.1.6.
A double-offset error in DPDK's vhost log-mapping calculation (lib/vhost) lets local attackers with low privileges (PR:L) - including a guest that controls a virtio device serviced by the vulnerable vhost-user backend - trigger incorrect host memory accesses that compromise confidentiality, integrity and availability, giving a 7.8 HIGH rating (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is tracked by Red Hat and ships in Fast Datapath for RHEL 8, 9 and 10, which in turn is consumed by Red Hat Enterprise Linux 8/9/10, OpenShift Container Platform 4 and OpenStack Platform 13 (Queens), so exposure is concentrated in OVS-DPDK accelerated virtualization and NFV hosts that exercise the vhost log-mapping path (for example during guest dirty-page logging/live migration). No public exploit identified at time of analysis, and no CISA KEV listing or exploit code is referenced in the available intelligence.
Missing authorization in Papermerge Core through 3.5.3 lets any authenticated user seize control of documents and folders they do not own by supplying the victim's node UUID to the shared-nodes API, then granting themselves an arbitrary role to read, modify, delete, or unshare those nodes. Exploitation requires a valid low-privileged account and knowledge of the target UUID (which is a non-enumerable random identifier, reflected as the AT:P attack-complexity component in the assessed vector), so opportunistic mass exploitation is impractical and real risk concentrates in multi-tenant or shared-link environments where UUIDs may leak. The vendor has released a fix, and no public exploit was identified at time of analysis.
Stored visual overlay injection in Discourse before 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 allows an authenticated user with posting permission to embed misleading or fraudulent UI content in posts by controlling a fetched webpage and its oEmbed response alongside an allowlisted iframe. The authoritative assessment rates this as limited integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) rather than the vendor/GHSA 7.7 high score, because exploitation requires a posting account, external attacker-controlled infrastructure, and an iframe source matching the site's configured allowlist; it does not expose restricted data, affect availability, or bypass Discourse CSP. No public exploit was identified at time of analysis, and vendor patches are available in 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Remote code execution in GitPython releases before 3.2.0 (CVE-2026-110857) allows unauthenticated attackers to execute arbitrary commands through Git.ls_remote, which forwards a caller-supplied remote URL without the check_unsafe_protocols validation that normally blocks dangerous transports, notably ext:: remote-helper URLs when Git's protocol.ext.allow setting permits them. Exploitation is conditional rather than trivial: a consuming application must pass an attacker-controlled URL into the affected API (user interaction is required per the assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:R), and a default Git configuration that rejects the ext transport blocks the primary ls_remote path, while the related merge_base and IndexFile.move option-injection paths remain similarly unguarded. No public exploit identified at time of analysis; the flaw is fixed in GitPython 3.2.0.