Account takeover in the EnergizeLab Eilik NestJS authentication service allows any registered user to hijack another account by manipulating a user ID field in account update requests, a mass assignment flaw (CWE-639). All versions of the service are affected (CPE: cpe:2.3:a:energizelab:nestjs_auth_service:*:*:*:*:*:*:*:*), and exploitation requires only a valid low-privilege account (PR:L) over the network with no user interaction. No public exploit has been identified at time of analysis, though the flaw is trivially automatable and carries a CVSS base score of 8.8.
Password reset authorization bypass in ELADMIN v2.7 and earlier allows any authenticated user, regardless of role, to reset arbitrary account passwords-including the built-in administrator-by sending PUT /api/users/resetPwd. The endpoint lacks the method-level authorization check applied to other user-management endpoints and performs no role or ownership validation in UserServiceImpl.resetPwd, so a low-privileged session can take over privileged accounts. No public exploit was identified at time of analysis, but the CVSS 3.1 score is 8.8 (PR:L) and the flaw is a genuine high-priority broken-access-control issue; risk is highest for internet-facing instances or those allowing self-service account creation.
Authenticated SQL injection in Tianji before 1.31.29 allows any workspace member - even a read-only viewer - to execute arbitrary SQL against the shared PostgreSQL database by supplying a crafted timezone value through analytics request data or the timezone HTTP header. The getDateQuery() helper in src/server/utils/prisma.ts interpolates that value into raw SQL via Prisma.sql() without parameter binding, so an attacker can disclose or modify credentials, API keys and tenant data, or make the service unavailable. No public exploit code has been identified at time of analysis; the vendor-released fix is 1.31.29.
Security-constraint bypass in Eclipse Jetty leaves some request URL patterns unprotected when annotation and deployment-descriptor security metadata are mixed, specifically in the jetty-annotations and jetty-eeN-annotations modules. The flaw triggers only in a narrow application layout: a servlet declared in web.xml with more than one url-pattern, a web.xml security-constraint that covers only a subset of those patterns, and @ServletSecurity annotations present at the same time, in which case the Jakarta Servlet specification's authoritative url-pattern precedence rules are not applied and the uncovered patterns remain reachable. Because the resulting access is reachable over the network with no credentials (CVSS 4.0 AV:N/PR:N/UI:N, independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N), an unauthenticated remote attacker can read content that should have been restricted, yielding a high confidentiality impact with a low integrity impact and no availability impact; exploitation is strictly gated by the application-level web.xml/annotation layout rather than by the Jetty version alone, and no public exploit identified at time of analysis.
Cross-site request forgery in XXL-JOB 3.5.0-SNAPSHOT and earlier lets an attacker riding an authenticated administrator's browser session create, modify, or delete console user accounts through the unprotected /user/insert, /user/update, and /user/delete endpoints in JobUserController. The flaw is scored CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no attacker privileges are required, but success depends entirely on a logged-in admin being lured into visiting an attacker-controlled page, since the endpoints carry no anti-CSRF token and do not restrict HTTP method. No public exploit code and no CISA KEV entry were identified at time of analysis, and the practical impact is limited to user-management state (account creation, privilege changes, and deletion) on admin consoles that are reachable from the victim's browser.
Memory corruption in Google Chrome's DOM implementation allows remote attackers to execute arbitrary code within the browser's renderer sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 155.0.8059.84 are affected; exploitation is unauthenticated (CVSS PR:N) but requires the user to navigate to attacker-controlled content (UI:R), and the resulting code execution is contained by the sandbox (S:U), so host compromise would require a separate sandbox-escape vulnerability. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none, though the vendor's Chrome severity rating is High and technical impact is total for the compromised renderer; a vendor patch is available in Chrome 155.0.8059.84 and the corresponding extended stable update.
Privilege escalation in the Fluent CRM WordPress plugin version 3.2.5 and earlier allows an authenticated low-privileged user - such as a subscriber or self-registered account - to elevate their privileges and gain control over site resources, with a CVSS 3.1 score of 8.8 and high impact to confidentiality, integrity, and availability. Exploitation is not anonymous: it requires a valid low-privilege WordPress account plus an active vulnerable plugin installation, but no user interaction is needed (PR:L, UI:N) and no non-default configuration is named in the advisory. No public exploit identified at time of analysis; this is a genuine priority, not a high-CVSS-but-low-real-risk issue.
Memory corruption in Google Chrome's Workers component affects versions prior to 155.0.8059.84 and can allow a remote attacker to execute arbitrary code inside the browser's renderer sandbox when a victim visits a crafted HTML page. The CVSS vector indicates network reachability, no authentication, and required user interaction, with high confidentiality, integrity, and availability impact inside the sandbox; however, Scope is Unchanged, so full host compromise requires a separate sandbox escape. Assessment signals conflict and should be weighed carefully: CVSS is 8.8 while Chromium rated it Medium, SSVC says exploitation is none and automatable is no, and no public exploit identified at time of analysis; a vendor patch is available.
Use-after-free in Google Chrome's compositing pipeline lets an unauthenticated remote attacker execute arbitrary code within the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.84. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) even though Google rates it Chromium severity Medium, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording no observed exploitation. Because the resulting code execution stays inside the sandbox, full host compromise would require chaining a separate sandbox escape, which tempers the real-world severity despite the high vector score.
Use-after-free in Google Chrome's Prerender component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page, and Google rates the flaw Critical with a CVSS base score of 8.8. All Chrome builds prior to 155.0.8059.84 are affected, and exploitation requires user interaction (UI:R) since the attacker cannot trigger the flaw without the victim loading the malicious content, though no authentication or special privileges are needed. Vendor-released patch: 155.0.8059.84; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the SSVC assessment records exploitation as none, making this a high-priority patching target rather than an emergency.
Memory corruption in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 lets a remote, unauthenticated attacker achieve arbitrary code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (CVSS UI:R) - the target must navigate to attacker-controlled or compromised web content - and no public exploit code has been identified at time of analysis, with CISA SSVC rating current exploitation as 'none'. Because the code execution is explicitly confined to the sandbox (S:U), full host compromise would require chaining a separate sandbox-escape vulnerability, making this a high-priority patch item rather than an emergency.
Use-after-free in the V8 JavaScript engine in Google Chrome before 155.0.8059.84 allows unauthenticated remote attackers to achieve arbitrary code execution inside the renderer sandbox by persuading a victim to load a crafted HTML page; only default JavaScript settings are required, with no privileges needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Vendor patches are available in Chrome 155.0.8059.84, and no public exploit code has been identified at time of analysis per CISA SSVC (Exploitation: none). The resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability would be required to compromise the underlying host; the exposure window closes once the browser auto-updates to the patched build.
Use-after-free in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Successful exploitation is gated by mandatory user interaction (CVSS UI:R) and needs no authentication (PR:N), so a single visit to an attacker-controlled or compromised page is enough, though the resulting code execution stays confined to the renderer sandbox under the assessed S:U scope and would require a separate sandbox-escape to compromise the host. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in release 155.0.8059.84 (Chromium severity: High).
FreeBSD jail escape allows a local attacker with code execution inside a jail to break out of the jail's filesystem root restriction by abusing renameat(2) and fchdir(2) when the process has received a directory file descriptor from another jail. This requires a specialized cross-jail file descriptor passing setup and the target directory to reside on a filesystem reachable from the exploiting jail's root, making exploitation non-trivial and limited to specific configurations. No public exploit identified at time of analysis, and the EPSS score is 0.18% (7th percentile), indicating a low likelihood of exploitation.
Denial of service in Symfony's ExpressionLanguage component lets a remote, unauthenticated attacker crash the PHP process by submitting a single expression built from tens of thousands of nested unary operators, array/hash literals, binary operators, property accesses or ternaries. The parser places no bound on the depth of the node tree it builds, and when that tree is destroyed PHP's recursive free overflows the native stack; the crash occurs while the tree is being freed, so it happens even if the expression itself would never be evaluated. Symfony applications that lint user-supplied expressions - most directly through the #[Assert\ExpressionSyntax] validator, which forwards the validated value to ExpressionLanguage::lint(), or any code calling parse()/lint() on untrusted input - are affected in versions up to 5.4.53, 6.4.47, 7.4.20 and 8.1.8. Impact is availability-only (CVSS:4.0 base 8.7 per NVD; our independent CVSS:3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), there is no data exposure or code execution, no public exploit code has been identified at time of analysis, and vendor patches are available.
Unbounded recursion in the Symfony YAML inline lexer lets a single document made of deeply nested inline collections (for example [[[[...]]]] or {{{...'}) exhaust the PHP call stack, crashing the worker process or ending the request with a fatal error in symfony/yaml prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The highest-exposure path is fully unauthenticated: a controller using #[MapRequestPayload] with the Yaml component installed and no acceptFormat restriction will accept a YAML content-type request that reaches Parser::lexInlineStructure() directly, and any application that parses untrusted YAML is affected. Impact is availability-only per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), exploitation is bounded by whether attacker-controlled input ever reaches the parser and by PHP version and stack settings. Vendor-released fixes exist for all maintained branches and no public exploit identified at time of analysis.
Path traversal in wildfly-core's deployment content handler allows an authenticated JBoss EAP, WildFly, Fuse 7, or Single Sign-On 7 user who holds the Deployer RBAC role to escape the restricted deployment directory and create files with attacker-controlled content or delete arbitrary directories on the server, escalating to full management SuperUser privileges. Exploitation requires that the Deployer role be delegated to the attacker (CVSS vector shows PR:L - authenticated, not anonymous) plus a crafted deployment name containing traversal sequences; environments that reserve the Deployer role for fully trusted administrators face little practical exposure. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, so this is a credible, actionable priority rather than an emergency.
Authenticated path traversal in QNAP Video Station before 5.8.8 allows a remote attacker with a valid low-privileged user account to read arbitrary files and system data outside the intended application directory. The flaw is CWE-22 and requires network access with low complexity and no user interaction, but the PR:L vector means an attacker must first hold a Video Station account, limiting mass exploitation. no public exploit identified at time of analysis, and QNAP has released Video Station 5.8.8 as the fix. The vendor CVSS 4.0 score is 8.7, but independent assessment scopes impact to confidentiality only, so it is a genuine moderate-priority issue rather than a top-tier emergency.
Unauthenticated remote attackers can crash Dragonfly through 2.0.2 by issuing a single HRANDFIELD, ZRANDMEMBER, or SRANDMEMBER command with a large negative COUNT against a key holding at least one element, causing an unbounded memory allocation that drives the process into the OOM killer and terminates the instance for every connected client. The CVSS 4.0 vector (8.7) and the independent CVSS 3.1 assessment both rate this AV:N/AC:L/PR:N/UI:N with availability-only impact (C:N/I:N/A:H), so no credentials or user interaction are required out of the box, although the attacker must be able to reach the Dragonfly port and a key of the matching type must exist (or be creatable). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; practical risk is concentrated on internet-exposed or unauthenticated Dragonfly deployments.
Improper link resolution (CWE-59) in QNAP Virtualization Station before 4.1.1.130 allows an authenticated remote attacker with a low-privilege user account to manipulate a symbolic link that is later followed by a privileged file operation, achieving high confidentiality, integrity, and availability impact (CVSS 8.7). This is a credible, elevated-priority issue for environments running the Virtualization Station (QKVM) add-on, though not a drop-everything emergency; exploitation requires the app to be installed and the attacker to hold a valid low-privilege account, and no public exploit code or active exploitation (KEV) has been identified at time of analysis. Upgrade to 4.1.1.130 or later to remediate.
Unauthenticated remote attackers can read sensitive data from QNAP NAS devices running the optional Video Station (VideoStationPro) application prior to 5.8.8 by exploiting a CWE-639 authorization bypass through a user-controlled key. The vendor rates the flaw 8.7 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and our independent assessment scores it 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a confidentiality-only impact with no integrity or availability loss. Exploitation requires Video Station to be installed and network-reachable on a QTS/QuTS NAS, and no public exploit code or CISA KEV listing was identified at time of analysis, so this is a high-priority information-disclosure issue rather than a confirmed actively exploited one.
Denial of service in Eclipse Vert.x JSON Schema validation (io.vertx:vertx-json-schema) allows a remote unauthenticated attacker to burn disproportionate CPU by sending a single moderately sized JSON array to any endpoint whose active schema uses the uniqueItems keyword. The affected ranges are 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and the defect propagates to the dependent modules vertx-web-openapi-router, vertx-web-validation and vertx-openapi. No public exploit code was identified at time of analysis, yet the issue is rated CVSS 4.0 8.7 (HIGH) entirely on availability impact (VA:H with VC:N/VI:N), and applications that do not use uniqueItems in attacker-reachable schemas or that cap request body/array size upstream are not practically exploitable.
Authorization bypass in IntentKit through 2.6.3 allows unauthenticated callers to execute owner-only, state-changing tools - wallet transfers, social posting, memory writes, and agent-to-agent calls - on agents reachable through WEB, API, Twitter, or Telegram contexts. The executor authorizes each tool call against the complete tool registry instead of the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, so an attacker who knows the exact de-advertised tool name and supplies valid arguments can drive it via indirect prompt injection or by replaying checkpoint and history data on a reused thread, with no human-in-the-loop or approval gate intervening (CWE-862, missing authorization). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; risk is driven by the fully remote, unauthenticated, low-complexity vector with high integrity impact (CVSS 4.0 base 8.7), and exploitation still requires knowledge of the specific restricted tool names plus a working injection or replay channel against an agent that actually has those tools registered.
Denial of service in AdonisJS HTTP Server (adonisjs/http-server) lets unauthenticated remote attackers stall the Node.js event loop: versions prior to 8.2.2 and 9.1.1 contain a catastrophic-backtracking regular expression in router.matchers.slug(), and a long slug ending in a character rejected by the final assertion triggers quadratic CPU consumption. Because the matcher runs during route matching and before route and group middleware, authentication or rate-limiting middleware attached to the affected route does not prevent the request from blocking the worker and starving unrelated requests and health checks. Impact is availability-only with no data exposure, the CVSS 4.0 base score is 8.7 (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no public exploit identified at time of analysis, and exploitation requires the application to explicitly apply the slug matcher to an externally reachable, attacker-controlled route parameter rather than affecting every AdonisJS deployment.
Unauthenticated remote denial of service in Symfony's HttpFoundation component (v4.1.0-BETA1 up to 5.4.54, v6.0.0-BETA1 up to 6.4.46, v7.0.0-BETA1 up to 7.4.19, and v8.0.0-BETA1 up to 8.1.7) allows any attacker who can send an HTTP request to burn roughly a second of CPU per request by placing a run of whitespace before a separator in the Cache-Control header. The flaw is automatically reachable because HeaderBag invokes HeaderUtils::split() on Cache-Control every time a Request object is constructed, so no authentication, plugin, or special configuration is required; a single crafted request costs about 813 ms on PHP 8.5 (17 spaces in an 8 KB header), doubling with each additional space, so sustained denial of service requires a stream of such requests rather than one packet. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but vendor patches are released and the reachability is trivial, making this a practical denial-of-service risk rather than a theoretical one.
NivoCart through 2.5.1 allows unauthenticated attackers to retrieve guest order invoices via the account/order download() action by iterating order_id values, exposing sensitive customer information such as names, addresses, telephone numbers, emails, purchased items, and order totals. The missing authorization check (CWE-862) affects installations that use guest checkout, as guest orders are stored with customer_id 0. No public exploit identified at time of analysis, though the enumeration is straightforward due to the lack of authentication requirements (CVSS PR:N).
Path traversal in QNAP's QcalAgent (Qcalendar) app for NAS devices lets a remote attacker who already holds a low-privileged user account read files and system data outside the intended directory. Only installations running QcalAgent 1.1.x below 1.1.10 are exposed, since the flaw is fixed in 1.1.10 and later, and the authentication prerequisite (PR:L in both the vendor CVSS 4.0 vector and our assessed CVSS 3.1 vector) means unauthenticated outsiders cannot reach it. No KEV listing and no public exploit code exists at time of analysis, but the vendor scores it 8.7 under CVSS 4.0, so patching should be prioritized wherever the optional app is installed and user accounts are shared broadly.
Authenticated path traversal in QNAP Download Station allows a remote user with a valid account to read arbitrary files outside the intended directory, potentially exposing system data. Affected versions are Download Station 5.10.x before 5.10.2.313 and 5.11.x before 5.11.3.322; the vendor has released fixes. No public exploit code or active exploitation has been identified at time of analysis, and the risk is conditional on valid credentials and network reachability to the NAS.
Privilege escalation in ThinkCMF through 8.0.1 allows an authenticated restricted backend administrator with a valid admin-type API token to call every admin REST API endpoint because RestAdminBaseController's Auth::check() fails open when no admin_api authorization rule exists. Such an attacker can list member emails and mobile numbers, disable members, and invoke PUT admin/roles/{id}/authorize to grant themselves full administrator rights. This is an elevated-priority issue gated by the precondition of possessing an admin-tier token, not an unauthenticated remote compromise; no CISA KEV entry is provided and no public exploit was identified at time of analysis.
Unauthenticated XML External Entity (XXE) injection in Ellucian WebAdvisor 3.2 lets remote attackers POST crafted XML to the /WebAdvisor/WebAdvisor endpoint and abuse an XML parser that has external entity and DTD resolution left enabled, yielding server-side request forgery, coerced NTLMv2 hash disclosure to an attacker-controlled SMB share, and arbitrary file read from the underlying Windows host through an out-of-band error-based channel. No authentication or user interaction is required (CVSS vector shows AV:N/PR:N/UI:N), and impact is confined to confidentiality with no integrity or availability effect; the vendor-published CVSS 4.0 score is 8.7 while our independent assessment rates the same vector as high confidentiality impact only. No public exploit code has been identified at time of analysis, and real-world exposure is limited to legacy higher-education deployments because WebAdvisor reached end-of-support in June 2022.
Unauthenticated remote attackers can exhaust server memory in Eclipse Vert.x deployments that expose the io.vertx:vertx-grpc-server component by sending small, highly compressed gRPC messages whose decompressed payload greatly exceeds the configured per-message maximum size, producing an availability-only denial-of-service condition. The affected ranges are Vert.x 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and the flaw is only reachable when a gRPC endpoint is network-reachable and accepts client-supplied message compression (standard gRPC gzip/deflate negotiation). The source reports a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H with no confidentiality or integrity impact); our independent CVSS 3.1 assessment agrees it is availability-only (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and there is no public exploit code and no CISA KEV listing identified at time of analysis - the practical precondition is simply that the per-message size limit is being relied upon as the sole defense, since that limit is enforced against compressed bytes only.
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user who holds the 'role create' or 'role update' permission to grant roles and privileges that their own account does not hold, escalating as far as full administrative access to the instance. The root cause is a missing authorization check (CWE-862) in the role-management functionality, so exposure is concentrated in deployments that delegate role administration to project or team leads rather than reserving it for trusted administrators; anonymous and ordinary unprivileged users cannot trigger it without that delegated permission. No public exploit code has been identified at time of analysis, and the vendor has shipped a fix in Nexus Repository 3.97.0.
Denial of service in Eclipse Vert.x HTTP proxy (io.vertx:vertx-http-proxy) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, allowing remote unauthenticated attackers to cause indefinite heap allocation. Exploitation requires the application to explicitly configure an intercepting body transformer-a non-default, developer-enabled feature-and the flaw lies in the transformer interceptor's reliance on a max buffered bytes limit that fails to keep per-request buffers bounded. No public exploit code has been identified at time of analysis; the CVSS 4.0 score is 8.7 with high availability impact.
Denial-of-service in Eclipse Vert.x allows unauthenticated remote attackers to exhaust server memory by sending compressed WebSocket frames that decompress to massive sizes (a zip bomb), because the WebSocket implementation lacks a maximum byte-allocation limit during decompression. Affected versions include 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and exploitation requires WebSocket compression (permessage-deflate) to be negotiated. No public exploit code has been identified at time of analysis, but a vendor advisory (GHSA-h722-h6c2-6j3c) is available; the impact is limited to availability loss.
Stored cross-site scripting in GYM One (all releases prior to 1.4.1) lets an attacker who can write to a user record's firstname, lastname, or email profile fields inject persistent JavaScript that executes in an administrator's browser whenever the administrator opens the user-management page at /admin/users/. Because the injected payload is rendered in the administrator's session, it can read or act on administrator-session data and perform privileged actions with the victim's rights until the poisoned record is removed; the CVSS 3.1 vector scores 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting the required low-privilege write access and the administrator's page visit as a user-interaction prerequisite, with scope change since the low-privileged author gains the administrator's privileges. The issue is fixed in version 1.4.1 per the vendor advisory and release tag, and no public exploit code was identified at time of analysis.
SQL injection in the WebCTI service shipped with Slican IPx telephone exchanges allows an authenticated, low-privilege attacker to read and modify data through the /webcti/admin_json.php endpoint. All IPx deployments running WebCTI on firmware earlier than 6.62.0100 are affected; exploitation requires a valid WebCTI subscriber/operator account (PR:L in the CVSS 4.0 vector) and network reachability to the endpoint, but no user interaction and no elevated privileges. CERT-PL and the vendor score the flaw at CVSS 4.0 base 8.7 (High) with high confidentiality and integrity impact and limited availability impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
An out-of-bounds write in HPE NonStop CIPSAM (version T0693L02^BAU and earlier) lets an attacker with local access and at least low-level privileges corrupt adjacent buffer memory, producing High integrity and High availability impact on the affected NonStop system. The CVSS 3.1 base score of 8.7 is driven by the changed-scope metric combined with those impact values rather than by remote reach - the vector is AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H, so this is an authenticated, local-access issue and is not remotely exploitable by an unauthenticated attacker. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic attacker population is narrowed by the requirement for prior credentials on a proprietary, access-controlled mission-critical platform.
Authenticated path traversal in QNAP QuMagie lets an attacker who already holds a QuMagie administrator account read files and system data outside the intended media library on the underlying QNAP NAS. The flaw is remote, network-reachable and low-complexity, but the PR:H privilege requirement in the CVSS vector means it is not exploitable by anonymous users against default installations; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped a fix in QuMagie 2.9.1 and later, so exposure is limited to NAS deployments still running older QuMagie builds and reachable by an admin-level account.
Authorization bypass in cool-admin-midway through 8.0.0 lets a department-scoped administrator holding sys:user:* permissions read, modify, or delete user records belonging to other departments by supplying an arbitrary user id to the /admin/sys/user/info, /admin/sys/user/update, or /admin/sys/user/delete endpoints. Because the base CRUD service never validates that the requested user id falls within the caller's department, the attacker can reset the password or roles of higher-privileged accounts (turning limited departmental admin rights into full account takeover) or delete accounts outright. Exploitation requires a valid authenticated admin account with user-management permissions, no anonymous access is possible, and no public exploit code was identified at time of analysis; the independently assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as high severity, treating the department-scoped admin as a low-privilege authenticated user rather than the high-privilege PR:H reading used in the 4.0 vector accompanying the CVE record.
SQL injection in Znuny's ticket-search backend (versions through 7.3.6) allows an authenticated remote attacker with a valid agent or customer account to inject arbitrary SQL through the ContentSearch parameter, enabling theft or modification of ticketing data. The flaw requires the attacker to reach the search interface and supply a value for a parameter that the code expects to contain only the literal 'AND' or 'OR', yet concatenates verbatim into the generated query (CWE-89). No public exploit code was identified at the time of analysis and no CISA KEV listing applies; the assessed impact is high confidentiality and integrity loss with no confirmed availability impact.
Arbitrary code execution in the Lenovo Legion Zone application allows an attacker positioned on the same logical network (shared LAN or Wi-Fi segment) to run code of their choosing on the affected host. Exploitation requires the attacker to already hold low-level privileges on the network (CVSS PR:L), needs no user interaction, and can affect confidentiality, integrity, and availability - reflected in the reported CVSS 4.0 base score of 8.6 (assessed as CVSS 3.1 8.2-equivalent, AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is a moderate-to-high severity but realistically constrained problem, because Legion Zone is distributed exclusively in the Chinese market and the attack surface is limited to adjacent-network reachability; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Missing actor-identity and object-ownership checks in the Discourse ActivityPub plugin allow remote attackers to edit, delete, or reply to federated posts without the permissions those actions normally require. Because inbound ActivityPub processing trusts the Activity actor declared inside the payload rather than the actor authenticated by the request's HTTP signature, anyone who can produce a valid HTTP signature for any federated actor can operate on posts that actor does not own; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) confirms no account on the target Discourse instance is needed, with the impact being unauthorized modification rather than data exposure. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), though the fixing commit is publicly visible and the affected CPE entry spans all plugin versions prior to that commit. Exposure is limited to Discourse instances that have installed and enabled the ActivityPub federation plugin, since stock Discourse does not ship it.
Authorization bypass in CyberArk Conjur 13.9.0 allows an authenticated user holding only limited privileges to perform actions on a policy branch they are not entitled to, and under specific circumstances to retrieve unauthorized secrets, alter administrative access controls on that branch, or cause a denial of service. The flaw is network-reachable and low-complexity (CVSS 4.0 8.6; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality and integrity impact), but it requires a pre-existing, valid Conjur account with access to the affected policy branch, so there is no unauthenticated or default-configuration mass-exploitation path. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status; the primary exposure is to Conjur 13.9.0 deployments with broad multi-tenant policy trees and loosely scoped low-privilege roles.
Jinja2 template injection in Ansible Operator Plugins (CWE-1336) lets an authenticated Kubernetes user who can create or modify a custom resource reconciled by an affected Ansible-based operator execute embedded Jinja2 expressions inside the operator pod, achieving remote code execution and escalating to the operator's service account. Because these operators typically hold cluster-wide RBAC, successful exploitation crosses a privilege boundary (CVSS 3.1 base 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting components of Red Hat Ansible Automation Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, the Migration Toolkit for Applications/Containers/Virtualization, OpenShift Service Mesh 3 and related Red Hat OpenShift and OpenStack streams. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the high attack complexity reflects the prerequisite that the targeted operator must pass attacker-controllable CR spec values into Jinja2 templating without sanitization. This is a genuinely high-priority flaw rather than a CVSS-inflated one, but with an important authentication caveat: purely anonymous or read-only users cannot trigger it.
Cleartext credential disclosure in P4 Search (formerly Helix Search) 2026.4.2 and earlier allows an authenticated administrator on the connected P4 Server to retrieve stored credentials through the product's configuration API, enabling privilege escalation beyond the administrator's intended scope. The defect is rooted in insufficient granularity of access control (CWE-1220): the API exposes secret material that administrators should not be able to read back, and the resulting credential exposure has cross-boundary confidentiality, integrity, and availability consequences per the assessed scope change (S:C). Exploitation is privilege-gated by the PR:H authentication requirement in the CVSS vector, so this is not reachable by anonymous or unprivileged users, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A vendor patch is available in P4 Search 2026.4.3.
Incorrect permission assignment (CWE-732) in QNAP Notes Station 3 allows a local attacker who already holds a valid low-privileged account on the NAS to abuse an insecurely permissioned critical resource created by the application, resulting in full compromise of confidentiality, integrity, and availability of the affected system's data. Only QNAP NAS devices with the Notes Station 3 app installed are affected, and exploitation is not possible remotely by an unauthenticated attacker - it requires local access plus a user account (AV:L, PR:L per CVSS:4.0 vector and the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; QNAP has released a fix in Notes Station 3 3.9.11 and later.
OS command injection in Unitronics UniLogic (versions prior to 1.41.329) and the UniStream Pro B10/C10 controllers it programs allows an authenticated low-privilege attacker who can reach a vulnerable input field to execute arbitrary operating-system commands on the affected device, resulting in full compromise of confidentiality and integrity plus partial availability impact. The flaw is network-reachable with low attack complexity and no user interaction, but requires valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which limits practical exposure to devices whose programming or web interface is reachable from an untrusted network segment. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported by Israel's National Cyber Directorate (INCD).
Out-of-bounds access to kernel heap memory in FreeBSD's System V semaphore subsystem allows an unprivileged local user to potentially escalate privileges or crash the kernel. The flaw is a race in semop(2): the invoking thread blocks, releases the per-set lock, and on wake-up re-validates its semaphore set using a 15-bit sequence number embedded in the IPC identifier; if roughly 32,768 sets are created and destroyed in the same table slot during that window, the counter wraps and the kernel falsely treats a freed/reused set as still valid, leading to an out-of-bounds dereference (CWE-787). Exploitation requires local code execution and a timing-dependent counter wrap, so practical risk is limited despite the total technical impact rating - no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none, Automatable: no.
Path traversal in PeaZip's archive object preview handler allows a crafted archive entry to escape the extraction directory and be handed directly to ShellExecuteW, so a victim who opens a malicious archive on Windows and invokes 'Preview with... -> Associated application' (Shift+Ctrl+O) on the rogue entry can be made to launch an arbitrary program already present on their system without the usual dangerous-extension warning. Affected are PeaZip 11.2.0 and earlier on Windows; no authentication or elevated privileges are needed, but exploitation is interaction-gated (local file delivery plus a deliberate multi-step preview action, CVSS 4.0 base 8.4 with AV:L/UI:A/PR:N and high C/I/A impact). A proof of concept was demonstrated against official vendor builds on two archive formats (.zip and .tar), confirming the defect is in PeaZip's own path handling rather than a single format parser; no CISA KEV entry or independent confirmation of active exploitation was reported at time of analysis. The practical limitation is that the flaw launches programs that already exist at the resolved path (for example a system binary) rather than dropping new attacker-supplied binaries.
QNAP Notes Station 3 versions prior to 3.9.11 fail to properly compartmentalize privileged functionality, so an attacker who already holds a local administrator account on the NAS can step outside the intended isolation boundary and compromise the confidentiality, integrity, and availability of the system. The vulnerability is strictly local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), meaning it is not remotely reachable and cannot be triggered by an unauthenticated or low-privileged user; realistic abuse is limited to malicious privileged insiders or privilege/isolation escape following an earlier compromise. QNAP has released a fix in Notes Station 3 3.9.11 and later, and there is no public exploit code or CISA KEV entry identified at time of analysis, so this is a moderate-priority, high-barrier issue rather than an urgent widespread threat.