Use-after-free in Google Chrome's Prerender component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page, and Google rates the flaw Critical with a CVSS base score of 8.8. All Chrome builds prior to 155.0.8059.84 are affected, and exploitation requires user interaction (UI:R) since the attacker cannot trigger the flaw without the victim loading the malicious content, though no authentication or special privileges are needed. Vendor-released patch: 155.0.8059.84; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the SSVC assessment records exploitation as none, making this a high-priority patching target rather than an emergency.
Memory corruption in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 lets a remote, unauthenticated attacker achieve arbitrary code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (CVSS UI:R) - the target must navigate to attacker-controlled or compromised web content - and no public exploit code has been identified at time of analysis, with CISA SSVC rating current exploitation as 'none'. Because the code execution is explicitly confined to the sandbox (S:U), full host compromise would require chaining a separate sandbox-escape vulnerability, making this a high-priority patch item rather than an emergency.
Use-after-free in the V8 JavaScript engine in Google Chrome before 155.0.8059.84 allows unauthenticated remote attackers to achieve arbitrary code execution inside the renderer sandbox by persuading a victim to load a crafted HTML page; only default JavaScript settings are required, with no privileges needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Vendor patches are available in Chrome 155.0.8059.84, and no public exploit code has been identified at time of analysis per CISA SSVC (Exploitation: none). The resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability would be required to compromise the underlying host; the exposure window closes once the browser auto-updates to the patched build.
Use-after-free in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Successful exploitation is gated by mandatory user interaction (CVSS UI:R) and needs no authentication (PR:N), so a single visit to an attacker-controlled or compromised page is enough, though the resulting code execution stays confined to the renderer sandbox under the assessed S:U scope and would require a separate sandbox-escape to compromise the host. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in release 155.0.8059.84 (Chromium severity: High).
FreeBSD jail escape allows a local attacker with code execution inside a jail to break out of the jail's filesystem root restriction by abusing renameat(2) and fchdir(2) when the process has received a directory file descriptor from another jail. This requires a specialized cross-jail file descriptor passing setup and the target directory to reside on a filesystem reachable from the exploiting jail's root, making exploitation non-trivial and limited to specific configurations. No public exploit identified at time of analysis, and the EPSS score is 0.18% (7th percentile), indicating a low likelihood of exploitation.
Denial of service in Symfony's ExpressionLanguage component lets a remote, unauthenticated attacker crash the PHP process by submitting a single expression built from tens of thousands of nested unary operators, array/hash literals, binary operators, property accesses or ternaries. The parser places no bound on the depth of the node tree it builds, and when that tree is destroyed PHP's recursive free overflows the native stack; the crash occurs while the tree is being freed, so it happens even if the expression itself would never be evaluated. Symfony applications that lint user-supplied expressions - most directly through the #[Assert\ExpressionSyntax] validator, which forwards the validated value to ExpressionLanguage::lint(), or any code calling parse()/lint() on untrusted input - are affected in versions up to 5.4.53, 6.4.47, 7.4.20 and 8.1.8. Impact is availability-only (CVSS:4.0 base 8.7 per NVD; our independent CVSS:3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), there is no data exposure or code execution, no public exploit code has been identified at time of analysis, and vendor patches are available.
Unbounded recursion in the Symfony YAML inline lexer lets a single document made of deeply nested inline collections (for example [[[[...]]]] or {{{...'}) exhaust the PHP call stack, crashing the worker process or ending the request with a fatal error in symfony/yaml prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The highest-exposure path is fully unauthenticated: a controller using #[MapRequestPayload] with the Yaml component installed and no acceptFormat restriction will accept a YAML content-type request that reaches Parser::lexInlineStructure() directly, and any application that parses untrusted YAML is affected. Impact is availability-only per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), exploitation is bounded by whether attacker-controlled input ever reaches the parser and by PHP version and stack settings. Vendor-released fixes exist for all maintained branches and no public exploit identified at time of analysis.
Path traversal in wildfly-core's deployment content handler allows an authenticated JBoss EAP, WildFly, Fuse 7, or Single Sign-On 7 user who holds the Deployer RBAC role to escape the restricted deployment directory and create files with attacker-controlled content or delete arbitrary directories on the server, escalating to full management SuperUser privileges. Exploitation requires that the Deployer role be delegated to the attacker (CVSS vector shows PR:L - authenticated, not anonymous) plus a crafted deployment name containing traversal sequences; environments that reserve the Deployer role for fully trusted administrators face little practical exposure. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, so this is a credible, actionable priority rather than an emergency.
Authenticated path traversal in QNAP Video Station before 5.8.8 allows a remote attacker with a valid low-privileged user account to read arbitrary files and system data outside the intended application directory. The flaw is CWE-22 and requires network access with low complexity and no user interaction, but the PR:L vector means an attacker must first hold a Video Station account, limiting mass exploitation. no public exploit identified at time of analysis, and QNAP has released Video Station 5.8.8 as the fix. The vendor CVSS 4.0 score is 8.7, but independent assessment scopes impact to confidentiality only, so it is a genuine moderate-priority issue rather than a top-tier emergency.
Unauthenticated remote attackers can crash Dragonfly through 2.0.2 by issuing a single HRANDFIELD, ZRANDMEMBER, or SRANDMEMBER command with a large negative COUNT against a key holding at least one element, causing an unbounded memory allocation that drives the process into the OOM killer and terminates the instance for every connected client. The CVSS 4.0 vector (8.7) and the independent CVSS 3.1 assessment both rate this AV:N/AC:L/PR:N/UI:N with availability-only impact (C:N/I:N/A:H), so no credentials or user interaction are required out of the box, although the attacker must be able to reach the Dragonfly port and a key of the matching type must exist (or be creatable). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; practical risk is concentrated on internet-exposed or unauthenticated Dragonfly deployments.
Improper link resolution (CWE-59) in QNAP Virtualization Station before 4.1.1.130 allows an authenticated remote attacker with a low-privilege user account to manipulate a symbolic link that is later followed by a privileged file operation, achieving high confidentiality, integrity, and availability impact (CVSS 8.7). This is a credible, elevated-priority issue for environments running the Virtualization Station (QKVM) add-on, though not a drop-everything emergency; exploitation requires the app to be installed and the attacker to hold a valid low-privilege account, and no public exploit code or active exploitation (KEV) has been identified at time of analysis. Upgrade to 4.1.1.130 or later to remediate.
Unauthenticated remote attackers can read sensitive data from QNAP NAS devices running the optional Video Station (VideoStationPro) application prior to 5.8.8 by exploiting a CWE-639 authorization bypass through a user-controlled key. The vendor rates the flaw 8.7 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and our independent assessment scores it 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a confidentiality-only impact with no integrity or availability loss. Exploitation requires Video Station to be installed and network-reachable on a QTS/QuTS NAS, and no public exploit code or CISA KEV listing was identified at time of analysis, so this is a high-priority information-disclosure issue rather than a confirmed actively exploited one.
Denial of service in Eclipse Vert.x JSON Schema validation (io.vertx:vertx-json-schema) allows a remote unauthenticated attacker to burn disproportionate CPU by sending a single moderately sized JSON array to any endpoint whose active schema uses the uniqueItems keyword. The affected ranges are 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and the defect propagates to the dependent modules vertx-web-openapi-router, vertx-web-validation and vertx-openapi. No public exploit code was identified at time of analysis, yet the issue is rated CVSS 4.0 8.7 (HIGH) entirely on availability impact (VA:H with VC:N/VI:N), and applications that do not use uniqueItems in attacker-reachable schemas or that cap request body/array size upstream are not practically exploitable.
Authorization bypass in IntentKit through 2.6.3 allows unauthenticated callers to execute owner-only, state-changing tools - wallet transfers, social posting, memory writes, and agent-to-agent calls - on agents reachable through WEB, API, Twitter, or Telegram contexts. The executor authorizes each tool call against the complete tool registry instead of the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, so an attacker who knows the exact de-advertised tool name and supplies valid arguments can drive it via indirect prompt injection or by replaying checkpoint and history data on a reused thread, with no human-in-the-loop or approval gate intervening (CWE-862, missing authorization). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; risk is driven by the fully remote, unauthenticated, low-complexity vector with high integrity impact (CVSS 4.0 base 8.7), and exploitation still requires knowledge of the specific restricted tool names plus a working injection or replay channel against an agent that actually has those tools registered.
Denial of service in AdonisJS HTTP Server (adonisjs/http-server) lets unauthenticated remote attackers stall the Node.js event loop: versions prior to 8.2.2 and 9.1.1 contain a catastrophic-backtracking regular expression in router.matchers.slug(), and a long slug ending in a character rejected by the final assertion triggers quadratic CPU consumption. Because the matcher runs during route matching and before route and group middleware, authentication or rate-limiting middleware attached to the affected route does not prevent the request from blocking the worker and starving unrelated requests and health checks. Impact is availability-only with no data exposure, the CVSS 4.0 base score is 8.7 (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no public exploit identified at time of analysis, and exploitation requires the application to explicitly apply the slug matcher to an externally reachable, attacker-controlled route parameter rather than affecting every AdonisJS deployment.
Unauthenticated remote denial of service in Symfony's HttpFoundation component (v4.1.0-BETA1 up to 5.4.54, v6.0.0-BETA1 up to 6.4.46, v7.0.0-BETA1 up to 7.4.19, and v8.0.0-BETA1 up to 8.1.7) allows any attacker who can send an HTTP request to burn roughly a second of CPU per request by placing a run of whitespace before a separator in the Cache-Control header. The flaw is automatically reachable because HeaderBag invokes HeaderUtils::split() on Cache-Control every time a Request object is constructed, so no authentication, plugin, or special configuration is required; a single crafted request costs about 813 ms on PHP 8.5 (17 spaces in an 8 KB header), doubling with each additional space, so sustained denial of service requires a stream of such requests rather than one packet. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but vendor patches are released and the reachability is trivial, making this a practical denial-of-service risk rather than a theoretical one.
NivoCart through 2.5.1 allows unauthenticated attackers to retrieve guest order invoices via the account/order download() action by iterating order_id values, exposing sensitive customer information such as names, addresses, telephone numbers, emails, purchased items, and order totals. The missing authorization check (CWE-862) affects installations that use guest checkout, as guest orders are stored with customer_id 0. No public exploit identified at time of analysis, though the enumeration is straightforward due to the lack of authentication requirements (CVSS PR:N).
Path traversal in QNAP's QcalAgent (Qcalendar) app for NAS devices lets a remote attacker who already holds a low-privileged user account read files and system data outside the intended directory. Only installations running QcalAgent 1.1.x below 1.1.10 are exposed, since the flaw is fixed in 1.1.10 and later, and the authentication prerequisite (PR:L in both the vendor CVSS 4.0 vector and our assessed CVSS 3.1 vector) means unauthenticated outsiders cannot reach it. No KEV listing and no public exploit code exists at time of analysis, but the vendor scores it 8.7 under CVSS 4.0, so patching should be prioritized wherever the optional app is installed and user accounts are shared broadly.
Authenticated path traversal in QNAP Download Station allows a remote user with a valid account to read arbitrary files outside the intended directory, potentially exposing system data. Affected versions are Download Station 5.10.x before 5.10.2.313 and 5.11.x before 5.11.3.322; the vendor has released fixes. No public exploit code or active exploitation has been identified at time of analysis, and the risk is conditional on valid credentials and network reachability to the NAS.
Privilege escalation in ThinkCMF through 8.0.1 allows an authenticated restricted backend administrator with a valid admin-type API token to call every admin REST API endpoint because RestAdminBaseController's Auth::check() fails open when no admin_api authorization rule exists. Such an attacker can list member emails and mobile numbers, disable members, and invoke PUT admin/roles/{id}/authorize to grant themselves full administrator rights. This is an elevated-priority issue gated by the precondition of possessing an admin-tier token, not an unauthenticated remote compromise; no CISA KEV entry is provided and no public exploit was identified at time of analysis.
Unauthenticated XML External Entity (XXE) injection in Ellucian WebAdvisor 3.2 lets remote attackers POST crafted XML to the /WebAdvisor/WebAdvisor endpoint and abuse an XML parser that has external entity and DTD resolution left enabled, yielding server-side request forgery, coerced NTLMv2 hash disclosure to an attacker-controlled SMB share, and arbitrary file read from the underlying Windows host through an out-of-band error-based channel. No authentication or user interaction is required (CVSS vector shows AV:N/PR:N/UI:N), and impact is confined to confidentiality with no integrity or availability effect; the vendor-published CVSS 4.0 score is 8.7 while our independent assessment rates the same vector as high confidentiality impact only. No public exploit code has been identified at time of analysis, and real-world exposure is limited to legacy higher-education deployments because WebAdvisor reached end-of-support in June 2022.
Unauthenticated remote attackers can exhaust server memory in Eclipse Vert.x deployments that expose the io.vertx:vertx-grpc-server component by sending small, highly compressed gRPC messages whose decompressed payload greatly exceeds the configured per-message maximum size, producing an availability-only denial-of-service condition. The affected ranges are Vert.x 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and the flaw is only reachable when a gRPC endpoint is network-reachable and accepts client-supplied message compression (standard gRPC gzip/deflate negotiation). The source reports a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H with no confidentiality or integrity impact); our independent CVSS 3.1 assessment agrees it is availability-only (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and there is no public exploit code and no CISA KEV listing identified at time of analysis - the practical precondition is simply that the per-message size limit is being relied upon as the sole defense, since that limit is enforced against compressed bytes only.
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user who holds the 'role create' or 'role update' permission to grant roles and privileges that their own account does not hold, escalating as far as full administrative access to the instance. The root cause is a missing authorization check (CWE-862) in the role-management functionality, so exposure is concentrated in deployments that delegate role administration to project or team leads rather than reserving it for trusted administrators; anonymous and ordinary unprivileged users cannot trigger it without that delegated permission. No public exploit code has been identified at time of analysis, and the vendor has shipped a fix in Nexus Repository 3.97.0.
Denial of service in Eclipse Vert.x HTTP proxy (io.vertx:vertx-http-proxy) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, allowing remote unauthenticated attackers to cause indefinite heap allocation. Exploitation requires the application to explicitly configure an intercepting body transformer-a non-default, developer-enabled feature-and the flaw lies in the transformer interceptor's reliance on a max buffered bytes limit that fails to keep per-request buffers bounded. No public exploit code has been identified at time of analysis; the CVSS 4.0 score is 8.7 with high availability impact.
Denial-of-service in Eclipse Vert.x allows unauthenticated remote attackers to exhaust server memory by sending compressed WebSocket frames that decompress to massive sizes (a zip bomb), because the WebSocket implementation lacks a maximum byte-allocation limit during decompression. Affected versions include 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and exploitation requires WebSocket compression (permessage-deflate) to be negotiated. No public exploit code has been identified at time of analysis, but a vendor advisory (GHSA-h722-h6c2-6j3c) is available; the impact is limited to availability loss.
Stored cross-site scripting in GYM One (all releases prior to 1.4.1) lets an attacker who can write to a user record's firstname, lastname, or email profile fields inject persistent JavaScript that executes in an administrator's browser whenever the administrator opens the user-management page at /admin/users/. Because the injected payload is rendered in the administrator's session, it can read or act on administrator-session data and perform privileged actions with the victim's rights until the poisoned record is removed; the CVSS 3.1 vector scores 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting the required low-privilege write access and the administrator's page visit as a user-interaction prerequisite, with scope change since the low-privileged author gains the administrator's privileges. The issue is fixed in version 1.4.1 per the vendor advisory and release tag, and no public exploit code was identified at time of analysis.
SQL injection in the WebCTI service shipped with Slican IPx telephone exchanges allows an authenticated, low-privilege attacker to read and modify data through the /webcti/admin_json.php endpoint. All IPx deployments running WebCTI on firmware earlier than 6.62.0100 are affected; exploitation requires a valid WebCTI subscriber/operator account (PR:L in the CVSS 4.0 vector) and network reachability to the endpoint, but no user interaction and no elevated privileges. CERT-PL and the vendor score the flaw at CVSS 4.0 base 8.7 (High) with high confidentiality and integrity impact and limited availability impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
An out-of-bounds write in HPE NonStop CIPSAM (version T0693L02^BAU and earlier) lets an attacker with local access and at least low-level privileges corrupt adjacent buffer memory, producing High integrity and High availability impact on the affected NonStop system. The CVSS 3.1 base score of 8.7 is driven by the changed-scope metric combined with those impact values rather than by remote reach - the vector is AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H, so this is an authenticated, local-access issue and is not remotely exploitable by an unauthenticated attacker. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic attacker population is narrowed by the requirement for prior credentials on a proprietary, access-controlled mission-critical platform.
Authenticated path traversal in QNAP QuMagie lets an attacker who already holds a QuMagie administrator account read files and system data outside the intended media library on the underlying QNAP NAS. The flaw is remote, network-reachable and low-complexity, but the PR:H privilege requirement in the CVSS vector means it is not exploitable by anonymous users against default installations; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped a fix in QuMagie 2.9.1 and later, so exposure is limited to NAS deployments still running older QuMagie builds and reachable by an admin-level account.
Authorization bypass in cool-admin-midway through 8.0.0 lets a department-scoped administrator holding sys:user:* permissions read, modify, or delete user records belonging to other departments by supplying an arbitrary user id to the /admin/sys/user/info, /admin/sys/user/update, or /admin/sys/user/delete endpoints. Because the base CRUD service never validates that the requested user id falls within the caller's department, the attacker can reset the password or roles of higher-privileged accounts (turning limited departmental admin rights into full account takeover) or delete accounts outright. Exploitation requires a valid authenticated admin account with user-management permissions, no anonymous access is possible, and no public exploit code was identified at time of analysis; the independently assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as high severity, treating the department-scoped admin as a low-privilege authenticated user rather than the high-privilege PR:H reading used in the 4.0 vector accompanying the CVE record.
SQL injection in Znuny's ticket-search backend (versions through 7.3.6) allows an authenticated remote attacker with a valid agent or customer account to inject arbitrary SQL through the ContentSearch parameter, enabling theft or modification of ticketing data. The flaw requires the attacker to reach the search interface and supply a value for a parameter that the code expects to contain only the literal 'AND' or 'OR', yet concatenates verbatim into the generated query (CWE-89). No public exploit code was identified at the time of analysis and no CISA KEV listing applies; the assessed impact is high confidentiality and integrity loss with no confirmed availability impact.
Arbitrary code execution in the Lenovo Legion Zone application allows an attacker positioned on the same logical network (shared LAN or Wi-Fi segment) to run code of their choosing on the affected host. Exploitation requires the attacker to already hold low-level privileges on the network (CVSS PR:L), needs no user interaction, and can affect confidentiality, integrity, and availability - reflected in the reported CVSS 4.0 base score of 8.6 (assessed as CVSS 3.1 8.2-equivalent, AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is a moderate-to-high severity but realistically constrained problem, because Legion Zone is distributed exclusively in the Chinese market and the attack surface is limited to adjacent-network reachability; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Missing actor-identity and object-ownership checks in the Discourse ActivityPub plugin allow remote attackers to edit, delete, or reply to federated posts without the permissions those actions normally require. Because inbound ActivityPub processing trusts the Activity actor declared inside the payload rather than the actor authenticated by the request's HTTP signature, anyone who can produce a valid HTTP signature for any federated actor can operate on posts that actor does not own; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) confirms no account on the target Discourse instance is needed, with the impact being unauthorized modification rather than data exposure. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), though the fixing commit is publicly visible and the affected CPE entry spans all plugin versions prior to that commit. Exposure is limited to Discourse instances that have installed and enabled the ActivityPub federation plugin, since stock Discourse does not ship it.
Authorization bypass in CyberArk Conjur 13.9.0 allows an authenticated user holding only limited privileges to perform actions on a policy branch they are not entitled to, and under specific circumstances to retrieve unauthorized secrets, alter administrative access controls on that branch, or cause a denial of service. The flaw is network-reachable and low-complexity (CVSS 4.0 8.6; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality and integrity impact), but it requires a pre-existing, valid Conjur account with access to the affected policy branch, so there is no unauthenticated or default-configuration mass-exploitation path. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status; the primary exposure is to Conjur 13.9.0 deployments with broad multi-tenant policy trees and loosely scoped low-privilege roles.
Jinja2 template injection in Ansible Operator Plugins (CWE-1336) lets an authenticated Kubernetes user who can create or modify a custom resource reconciled by an affected Ansible-based operator execute embedded Jinja2 expressions inside the operator pod, achieving remote code execution and escalating to the operator's service account. Because these operators typically hold cluster-wide RBAC, successful exploitation crosses a privilege boundary (CVSS 3.1 base 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), affecting components of Red Hat Ansible Automation Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, the Migration Toolkit for Applications/Containers/Virtualization, OpenShift Service Mesh 3 and related Red Hat OpenShift and OpenStack streams. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the high attack complexity reflects the prerequisite that the targeted operator must pass attacker-controllable CR spec values into Jinja2 templating without sanitization. This is a genuinely high-priority flaw rather than a CVSS-inflated one, but with an important authentication caveat: purely anonymous or read-only users cannot trigger it.
Cleartext credential disclosure in P4 Search (formerly Helix Search) 2026.4.2 and earlier allows an authenticated administrator on the connected P4 Server to retrieve stored credentials through the product's configuration API, enabling privilege escalation beyond the administrator's intended scope. The defect is rooted in insufficient granularity of access control (CWE-1220): the API exposes secret material that administrators should not be able to read back, and the resulting credential exposure has cross-boundary confidentiality, integrity, and availability consequences per the assessed scope change (S:C). Exploitation is privilege-gated by the PR:H authentication requirement in the CVSS vector, so this is not reachable by anonymous or unprivileged users, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A vendor patch is available in P4 Search 2026.4.3.
Incorrect permission assignment (CWE-732) in QNAP Notes Station 3 allows a local attacker who already holds a valid low-privileged account on the NAS to abuse an insecurely permissioned critical resource created by the application, resulting in full compromise of confidentiality, integrity, and availability of the affected system's data. Only QNAP NAS devices with the Notes Station 3 app installed are affected, and exploitation is not possible remotely by an unauthenticated attacker - it requires local access plus a user account (AV:L, PR:L per CVSS:4.0 vector and the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; QNAP has released a fix in Notes Station 3 3.9.11 and later.
OS command injection in Unitronics UniLogic (versions prior to 1.41.329) and the UniStream Pro B10/C10 controllers it programs allows an authenticated low-privilege attacker who can reach a vulnerable input field to execute arbitrary operating-system commands on the affected device, resulting in full compromise of confidentiality and integrity plus partial availability impact. The flaw is network-reachable with low attack complexity and no user interaction, but requires valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which limits practical exposure to devices whose programming or web interface is reachable from an untrusted network segment. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported by Israel's National Cyber Directorate (INCD).
Out-of-bounds access to kernel heap memory in FreeBSD's System V semaphore subsystem allows an unprivileged local user to potentially escalate privileges or crash the kernel. The flaw is a race in semop(2): the invoking thread blocks, releases the per-set lock, and on wake-up re-validates its semaphore set using a 15-bit sequence number embedded in the IPC identifier; if roughly 32,768 sets are created and destroyed in the same table slot during that window, the counter wraps and the kernel falsely treats a freed/reused set as still valid, leading to an out-of-bounds dereference (CWE-787). Exploitation requires local code execution and a timing-dependent counter wrap, so practical risk is limited despite the total technical impact rating - no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none, Automatable: no.
Path traversal in PeaZip's archive object preview handler allows a crafted archive entry to escape the extraction directory and be handed directly to ShellExecuteW, so a victim who opens a malicious archive on Windows and invokes 'Preview with... -> Associated application' (Shift+Ctrl+O) on the rogue entry can be made to launch an arbitrary program already present on their system without the usual dangerous-extension warning. Affected are PeaZip 11.2.0 and earlier on Windows; no authentication or elevated privileges are needed, but exploitation is interaction-gated (local file delivery plus a deliberate multi-step preview action, CVSS 4.0 base 8.4 with AV:L/UI:A/PR:N and high C/I/A impact). A proof of concept was demonstrated against official vendor builds on two archive formats (.zip and .tar), confirming the defect is in PeaZip's own path handling rather than a single format parser; no CISA KEV entry or independent confirmation of active exploitation was reported at time of analysis. The practical limitation is that the flaw launches programs that already exist at the resolved path (for example a system binary) rather than dropping new attacker-supplied binaries.
QNAP Notes Station 3 versions prior to 3.9.11 fail to properly compartmentalize privileged functionality, so an attacker who already holds a local administrator account on the NAS can step outside the intended isolation boundary and compromise the confidentiality, integrity, and availability of the system. The vulnerability is strictly local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), meaning it is not remotely reachable and cannot be triggered by an unauthenticated or low-privileged user; realistic abuse is limited to malicious privileged insiders or privilege/isolation escape following an earlier compromise. QNAP has released a fix in Notes Station 3 3.9.11 and later, and there is no public exploit code or CISA KEV entry identified at time of analysis, so this is a moderate-priority, high-barrier issue rather than an urgent widespread threat.
Incorrect permission assignment in QNAP Download Station (all builds prior to 5.10.1.312 or 5.11.2.321) lets a local attacker who already holds an administrator account on the NAS escalate that foothold into full compromise of the device's confidentiality, integrity and availability. The issue is access-gated rather than remotely reachable: the CVSS:4.0 vector marks local attack vector (AV:L) and high privileges (PR:H), so a remote or unauthenticated attacker cannot trigger it and no user interaction is required once admin access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), but vendor-released fixes are available, so the practical risk sits with deployments that share, weakly protect, or already have compromised QNAP admin credentials.
Memory corruption in the snap7 S7 communication library (through version 1.4.3) allows a rogue or impersonated PLC to overflow client-side buffers while handling ReadVar responses, crashing SCADA, HMI, gateway, and custom S7 client processes and corrupting their memory. The flaw is unauthenticated from the protocol perspective (PR:N) and needs no user interaction, but per the authoritative assessment it is only reachable when the attacker already occupies a trusted position in the S7 path of the victim client - an attacker-controlled, spoofed, or MITM'd PLC endpoint (the condition encoded by CVSS 4.0 AT:P); clients that communicate only with legitimate PLCs cannot be triggered. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; CVSS 4.0 base 8.3 (High), with the independent assessment scoring CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H.
Stored HTML injection in EspoCRM versions prior to 9.3.9 lets an unauthenticated remote sender place arbitrary HTML into the plain-text body of an email sent to a monitored group, IMAP, or email-to-Case mailbox; EspoCRM stores that body and renders it without escaping inside 'Email Received' stream notification emails delivered to users following the related record, allowing HTML injection and, in mail clients that execute embedded markup, JavaScript execution. Exploitation is constrained by the inbound-mail prerequisite, by required victim interaction (the follower must open the notification email, CVSS vector UI:R), and by mail-client behavior, yielding a moderate CVSS 3.1 score of 4.3 with limited integrity impact and no confidentiality or availability impact. Publicly available exploit code and the upstream fix commit are both public, but no confirmed active exploitation has been reported at time of analysis.
Improper authentication in Unitronics UniStream Pro B10/C10 controllers running UniLogic firmware prior to 1.41.329 allows a network-positioned attacker with low-level privileges to bypass authentication, yielding high confidentiality and integrity impact with low availability impact (CVSS 8.3). The flaw requires a valid low-privilege authenticated foothold (PR:L per the CVSS vector) and network reachability to the controller, with no user interaction; OT segmentation limits exposure. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, though the 'Authentication Bypass' tag suggests the exact authentication precondition should be confirmed in the INCD advisory.
Authenticated low-privilege attackers can exploit a format string vulnerability in Unitronics UniStream Pro B10/C10 controllers running UniLogic firmware prior to 1.41.329, potentially leading to memory corruption, sensitive information disclosure, and code execution. The flaw (CWE-134) is network-reachable and requires valid credentials but no user interaction, with high impact on confidentiality and integrity. No public exploit has been identified at time of analysis.
Improper memory-buffer bounds handling in Unitronics UniStream Pro PLCs (B10 and C10 hardware variants) running UniLogic firmware prior to 1.41.329 allows an attacker with network reachability and low-privilege authentication (CVSS PR:L) to corrupt memory and potentially achieve high confidentiality and integrity impact with limited availability impact (CVSS 8.3). Because these are OT/ICS controllers, successful exploitation could let an authenticated actor disrupt or manipulate the logic and data handled by the device rather than just crash it. The flaw was reported by Israel's INCD; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so exploitation is currently assessed as requiring deliberate, targeted access rather than opportunistic scanning. Devices already running UniLogic 1.41.329 or later are not affected.
The EnergizeLab Eilik NestJS authentication service grants device tokens for arbitrary robot serial numbers without requiring any credential, so an unauthenticated remote attacker can mint a valid token for any Eilik robot and impersonate that device against the vendor's cloud services. Rated 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N), the flaw is trivially reachable over the network with no authentication or user interaction, and the dominant impact is to integrity of device identity rather than to confidentiality or availability. There is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS percentile was supplied with this record, so the practical risk is a genuinely easy-to-exploit flaw with bounded, identity-spoofing impact and no confirmation of real-world use; assessment signals point the same way.
Paid fulfillment bypass in Lychee (Supporter/Pro editions) before 7.7.0: the checkout validators accept any OmnipayProviderType enum value, including the Dummy test gateway that is deliberately hidden from production checkout, so a remote unauthenticated buyer - where webshop_allow_guest_checkout is enabled - can start and finalize a session against the Dummy gateway and, with webshop_auto_fulfill_enabled on, have OrderCompletedListener::fullfillOrder() release the purchasable item without any real payment. The integrity impact is genuine but conditional (CVSS 4.0 base 8.3 with Attack Requirements: Present; assessed CVSS 3.1 8.3, C:L/I:H/A:N), since exploitation requires a paid Supporter/Pro instance running the webshop with at least one enabled purchasable item and the relevant opt-in flags. No public exploit identified at time of analysis, and the vendor has released a fixed version, 7.7.0.
Unauthenticated buyers on Lychee instances running the Supporter/Pro webshop can tamper with the parameters handed to the payment gateway, overriding the server-computed amount, currency, returnUrl, cancelUrl, or transactionId so that a gateway approves a payment for an attacker-chosen price while the merchant is underpaid and auto-fulfilled goods are still delivered. The flaw lives in CheckoutService::preparePurchaseParameters(), which merges the client-supplied additional_data array after the server's own purchase parameters, allowing later string keys to overwrite earlier ones before processPayment() reaches a non-PayPal Omnipay gateway. Exploitation is not a network-wide exposure: it requires an enabled webshop, at least one purchasable item, and an affected Omnipay gateway (PayPal is explicitly not affected), which sharply narrows the population at risk; no public exploit code was identified at time of analysis, though the upstream fix ships a regression test that demonstrates the parameter override, and no CISA KEV entry exists. This is best treated as a credible, prioritizable business-logic flaw rather than an inflated high-severity issue, since the integrity impact on the merchant's billing is real but the prerequisites are opt-in and non-default.