Factories compiled with Vyper 0.3.4 through 0.5.0b1 that forward an attacker-influenced code_offset into the create_from_blueprint builtin can be tricked into deploying contracts with zero runtime code. The compiler computes the remaining blueprint size with unchecked uint256 subtraction, so an offset larger than the blueprint's code size wraps to a small positive number and the copy silently yields empty bytecode; assets sent to the resulting codeless address, or initialization logic that assumes a working contract, can be permanently trapped. Impact is conditional rather than universal: only factories that both use this builtin and expose code_offset to callers are reachable (reflected in the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:L), no public exploit code has been identified at time of analysis, and no CISA KEV entry exists, so this is a moderate, conditional risk rather than a drop-everything priority.
Coraza WAF before 3.8.1 can be induced to record a decoy multipart filename for FILES-based inspection while a downstream application receives a different, attacker-chosen name, allowing upload-name restrictions to be bypassed when the backend honors RFC 5987 filename* parameters. The root cause is Go's mime.ParseMediaType, which silently discards filename* values whose charset is not us-ascii or utf-8, so a header such as filename*=iso-8859-1''shell.php is either masked by a benign plain filename or, when filename* appears alone, causes the part not to be classified as a file upload at all. Exploitation is unauthenticated but requires both FILES/FILES_SIZES-based Coraza rules and a backend that itself parses filename*, and no public exploit identified at time of analysis.
Out-of-bounds write in the Zephyr RTOS Nuvoton NPCX/NPCK eSPI Target-Attached-Flash driver lets an eSPI host that sends a flash write or RPMC OP1 request with an oversized 12-bit header length field push up to roughly 956 bytes of attacker-influenced data past a fixed 16-word buffer in .bss, and also causes up to 4 KB of adjacent controller SRAM to be programmed into SPI flash at a host-chosen address where the host can read it back. Only builds that explicitly enable CONFIG_ESPI_TAF on NPCX/NPCK silicon are exposed - no in-tree Zephyr board turns the option on by default - and the trigger requires host firmware or bus-level control of the eSPI link rather than ordinary host software, which is consistent with the assessed CVSS 6.3 vector (AV:L/PR:H). No public exploit code was identified at time of analysis, and the vendor has published a patched commit plus a GitHub security advisory.
IP spoofing in Go Chi before 5.4.0 allows an unauthenticated client that can reach the Go server directly to forge its apparent source address through the opt-in ClientIPFromXFF middleware. The middleware skips X-Forwarded-For entries that fall inside a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that same CIDR, so an attacker can append a trusted-looking proxy address and control the value returned by middleware.GetClientIP. This is a moderate-severity logic flaw (CWE-348) that matters only where applications use the derived client IP for allowlisting, rate limiting, geolocation, or audit logging; no public exploit identified at time of analysis.
Deeply nested JSON or JSONC documents fed into stream-json's FlexAssembler between versions 2.0.0 and 3.6.x can pin the Node.js event loop at full CPU, stalling every other operation in the host process. The trigger is the assembler's string and regular-expression path rules, which rebuild a full key-path string on every container start, so nesting depth D produces D joins of average cost D - quadratic work on a single thread. No credentials, no schema knowledge, and no user interaction are required (PR:N/UI:N), and the impact is availability only (C:N/I:N/A:H), making this a moderate operational-availability concern rather than an RCE or data-exposure emergency; no public exploit code was identified at time of analysis. Version 3.7.0 fixes the issue by adding a default maxDepth of 1024 that throws a RangeError for over-deep containers.
An out-of-bounds read in libmodulemd's modulemd v2 rpm-map YAML serialization path can crash applications that process crafted module metadata, producing a local denial of service. The bug is triggered only when the metadata declares multiple digest algorithm types and is serialized through the affected path; default single-digest metadata does not trigger it. The assessed impact is availability-only, with no confirmed code execution or data exposure, and no public exploit code or CISA KEV entry was identified at time of analysis.
Stack exhaustion in libmodulemd's xmd (extended metadata) parser lets anyone who can place crafted modulemd YAML in front of a consuming process crash it or exhaust its resources, an availability-only denial of service (CVSS 6.2, C:N/I:N/A:H). The defect is in the recursive YAML mapping/sequence helpers that convert xmd content into nested GVariant values with no recursion-depth or node-count ceiling, so deeply nested input overflows the stack. Affected builds ship in Red Hat Enterprise Linux 8, 9 and 10, Red Hat Hardened Images, and OpenShift Container Platform 4; the vector AV:L/PR:N/UI:N means the attacker must first get the malicious metadata onto a host that parses it (for example an attacker-controlled or third-party module repository consumed by DNF/libdnf), after which no authentication or user interaction is required. No public exploit code and no confirmed active exploitation were identified in the available intelligence at time of analysis.
Denial of service in libmodulemd can be triggered when a build compiled with rpmio support parses a highly compressible modulemd YAML file; the custom decompression read handler does not cap cumulative decompressed output before parsing, allowing CPU and memory exhaustion that can hang or crash the consuming process. The issue is scored CVSS 6.2 with a LOCAL vector, requires no authentication or user interaction once a malicious file reaches the parser, and is associated by CPE data with Red Hat Enterprise Linux 8, 9, and 10 plus related OpenShift and hardened image products. No public exploit code or CISA KEV-listed active exploitation was identified in the supplied intelligence.
Path traversal in Tenstorrent tt-metal up to and including 0.80.0 lets a malicious model checkpoint direct the loader to read a safetensors shard from outside the checkpoint directory, because weight_map filenames in model.safetensors.index.json are joined onto the checkpoint path without containment checking. The weakness is reachable remotely but gated by user interaction: someone must actually load an untrusted or attacker-supplied checkpoint, and the impact is read-oriented (an out-of-directory shard is pulled into the loaded state dict) rather than direct code execution, which is why the assessed severity is low (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N; upstream CVSS 4.0 score 2.1). Publicly available exploit code exists and the vendor has released a fix in v0.81.0-dev20261016; there is no indication of confirmed active exploitation (CISA KEV).
Path traversal in the Jackrong Finetuning Guide's Qwen MTP GGUF pipeline lets an unauthenticated remote attacker supply a crafted MTP weight_map whose shard_name value contains traversal sequences, causing files outside the intended model directory to be accessed when a victim runs the extract_mtp_heads function. The affected code is qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py through commit ef2b17f2798cd18cd85375080c35a58397ad0d09, distributed as a rolling release with no tagged versions. Publicly available exploit code exists, but impact is limited to low confidentiality, integrity, and availability with required user interaction, and there is no CISA KEV listing at time of analysis.
Path/file inclusion in oretnom23 File Management System PHP lets remote attackers influence the 'page' parameter processed by index.php's include() call, enabling limited local file disclosure or inclusion of attacker-controlled content. The application is distributed as a rolling release with no version identifiers, and the project has not provided a fixed build. No authentication is required (PR:N) but exploitation depends on passive user interaction (UI:P); publicly available exploit code exists, and impact is assessed as LOW (C:L/I:L/A:L).
Arbitrary file creation in BusyBox's libarchive component allows attackers to write files outside the intended extraction directory by supplying a crafted archive containing symlink or traversal path entries, triggered when a target user opens the malicious file (ZDI-CAN-27556). The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R scores 6.1, reflecting a local attack path that requires user interaction, no confidentiality impact, high integrity impact, and low availability impact, with writes confined to the privileges of the extracting process. No public exploit code has been identified at time of analysis, and real-world priority is low-to-moderate except in automated or server-side pipelines that unpack untrusted archives without human vetting.
Authenticated path traversal in wiki-go 1.9.1 and earlier lets low-privileged users abuse the Files Rename API to move or rename files outside the wiki's documents or pages/home storage roots. The flaw is in RenameFileHandler's handling of the currentPath and newName arguments, which accept traversal sequences such as ../ or absolute/backslash paths; publicly available exploit code exists. The vendor fixed it in 1.9.2, and the moderate CVSS 5.3 reflects limited confidentiality, integrity, and availability impact rather than code execution; no CISA KEV confirmation was provided.
Path traversal in Leomoon wiki-go through 1.9.1 allows authenticated users with editor-level privileges to read, overwrite, move, or restore documents outside the configured wiki documents directory via crafted paths to the editor and version API endpoints. The flaw is remotely reachable over HTTP but requires a valid editor session (CVSS PR:L); publicly available exploit code exists, and the vendor fixed it in 1.9.2. It is a moderate-risk issue rather than a top-priority one because untrusted users cannot exploit it without editor access.
Path traversal in OpenSCAP's Source DataStream (SDS) decomposition can allow a crafted datastream to create or modify files outside the intended output directory with the permissions of the process performing the decomposition. The issue affects OpenSCAP as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images; exploitation is local and requires the victim user or automated system to decompose an attacker-supplied SDS containing directory traversal sequences. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows a low-privileged authenticated remote attacker to manipulate the ID parameter handled by /orderdetail.php and influence backend database queries, with partial confidentiality, integrity, and availability impact per the assessed vector. Publicly available exploit code exists, but no CISA KEV entry or confirmed active exploitation is indicated in the supplied data. The application is a niche open-source PHP product, so realistic exposure is limited to deployed instances reachable by authenticated users.
Authenticated SQL injection in ProjectWorlds Advanced Library Management System 1.0 lets a low-privileged user who can reach the returned-book search form inject SQL through the datefrom or dateto parameters and read sensitive database contents. The flaw is a CWE-89 mysqli_query concatenation issue in returned_book_search.php; exploitation requires a valid account (CVSS PR:L) but no user interaction. Publicly available exploit code exists, and while no CISA KEV entry confirms active exploitation, this is a moderate-to-low real-world priority because the authentication prerequisite limits anonymous internet-wide attacks.
Trigger.dev before 4.5.6 allows cross-tenant deployment hijacking: an attacker holding any valid environment API key can POST a victim's deployment friendlyId to the background-workers endpoint and re-point an in-progress deployment to a worker in the attacker's environment. The flaw is an IDOR/CWE-639 in createDeploymentBackgroundWorkerV4, which resolves deployments by friendlyId without environment, project, or organization scoping; exploitation requires knowing the victim friendlyId and hitting the deployment while it is still in progress. Vendor patch 4.5.6 is available, and no public exploit identified at time of analysis.
Authenticated server-side request forgery (SSRF) in wiki-go versions up to 1.9.1 allows logged-in users to make the server fetch arbitrary internal or cloud-metadata URLs through the fetch-metadata endpoint in internal/handlers/metadata_api.go. The pre-patch handler only checked the URL scheme (http/https) and never validated the resolved destination IP, so an attacker with valid credentials can read limited confidential responses from reachable internal services (confidentiality impact only, no integrity or availability impact). Publicly available exploit code exists, and the vendor fixed the issue in 1.9.2 by adding outbound URL destination validation.
SQL injection in the /deleteproduct.php endpoint of itsourcecode Online Cake Ordering System 1.0 allows authenticated low-privilege users to manipulate the ID parameter and run arbitrary SQL against the application database. The issue is remotely reachable but requires a valid account (CVSS 5.3, PR:L), and publicly available exploit code exists via a GitHub issue; no CISA KEV active exploitation is confirmed. This is a moderate priority because the niche PHP project is unlikely to be internet-exposed and exploitation is gated by authentication.
SQL injection in itsourcecode Sales-and-Inventory-System lets authenticated low-privilege attackers alter database queries via the ID parameter in /pages/cust_edit.php, compromising confidentiality, integrity, and availability at a low level. Publicly available exploit code exists through a published GitHub issue, but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a moderate, not high-priority issue. The vendor uses rolling releases and has not responded, so no fixed version is available and defenses must focus on input validation and access control.
Cross-site scripting (CWE-79) in odf-kit 0.10.0 through 0.14.1 lets unauthenticated remote attackers inject HTML or script through crafted ODF style properties such as fo:color, which the ODT-to-HTML renderer concatenates unescaped into style attributes. The issue is exploitable only when a consumer converts an attacker-controlled ODT/ODS document to HTML and then displays that output in a browser or other HTML-rendering context, requiring user interaction (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code was identified at time of analysis, and version 0.14.2 contains the fix.
SQL injection in ProjectWorlds Advanced Library Management System 1.0 allows a low-privileged authenticated remote attacker to manipulate the admin_id argument in profile.php and alter backend mysqli_query statements, with limited confidentiality, integrity, and availability impact per the assessed CVSS 3.1 vector. Publicly available exploit code exists and the issue is remotely reachable, but authentication is required and no CISA KEV active-exploitation confirmation is present.
Authenticated SQL injection in itsourcecode Sales-and-Inventory-System allows a low-privilege logged-in user to inject arbitrary SQL through the ID argument of the /pages/cust_searchfrm.php customer search endpoint, potentially exposing or modifying backend database records. The project ships as a rolling release, so no discrete version numbers exist; all builds up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac are affected. Publicly available exploit code exists in the form of a public GitHub issue report, but there is no CISA KEV listing and no confirmed active exploitation; the vendor was notified through that issue and has not responded, and no vendor-released patch has been identified.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows an authenticated low-privilege user to manipulate the dateto and datefrom parameters in report_search.php and potentially read or modify limited database data. Publicly available exploit code exists, but the product is a demonstration/academic PHP application with an extremely narrow deployment footprint, so overall risk is low.
Authenticated SQL injection in itsourcecode Sales-and-Inventory-System allows a low-privileged user to manipulate the ID parameter on /pages/cust_del.php and alter database queries, with limited confidentiality, integrity, and availability impact. The product is unversioned, so all deployments are potentially affected, and publicly available exploit code exists; there is no CISA KEV confirmation of active exploitation. Signals are mixed but converge on a moderate, not urgent, priority because a valid login is required and the flaw is confined to a single endpoint.
Memory exhaustion in pypdf before 6.20.0 occurs when an application decodes a crafted PDF stream that declares an excessive number of filters or chains multiple filters that repeatedly pass large data, driving uncontrolled memory consumption and potential denial of service. The attacker must supply a malicious PDF and get the application to reach the stream-decoding path; authentication against the library is not required (PR:N), while the assessed vector reflects user interaction and attack requirements. The vendor fixed the issue in pypdf 6.20.0; no public exploit identified at time of analysis and no confirmed active exploitation were provided.
An infinite loop in pypdf's standard cross-reference table parser allows a crafted, truncated PDF to hang any Python application that parses untrusted documents with versions prior to 6.20.0. Because the parser does not validate that xref entry lines are the expected 20 bytes before consuming them, a file that ends mid-table drives the reader into a non-terminating loop, exhausting CPU and blocking the processing thread. Only availability is affected - no disclosure, modification, or code execution - and the attack requires the victim application to actually ingest the malicious file (CVSS 4.0 6.0; independent assessment agrees with high availability impact). No public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in pypdf versions prior to 6.20.1 occurs when crafted cyclic PDF outline or /Next tree structures are processed by writer-side object removal, causing an infinite loop that blocks the current process. Applications are affected only if they accept attacker-supplied PDFs and invoke tree/node removal paths such as find_outline_item or _remove_node_from_tree; merely opening or reading a PDF is insufficient. The vendor advisory GHSA-9mx8-4j7g-633p and PR #4188 address the issue by adding cycle detection, and upgrading to 6.20.1 resolves it; no public exploit or CISA KEV confirmation is present in the provided data.
Denial of service via infinite loop in pypdf's writer-side outline lookup: calling PdfWriter.find_outline_item on a crafted PDF whose document outline contains a cyclic hierarchy (looping /First or /Next pointers) causes the function to recurse or iterate indefinitely, hanging the calling Python process. All pypdf releases prior to 6.20.1 are affected; the exposure is limited to applications that both accept untrusted PDFs and specifically invoke this writer method, since documents that are only opened or read do not trigger the flaw. Impact is availability-only (process hang), with no memory corruption, data disclosure, or code execution; no public exploit code has been identified at time of analysis, and the issue does not appear in CISA KEV.
Apache Pulsar 2.8.0 through 4.2.x deployments that enable package management allow an authenticated user to read package contents belonging to another tenant by supplying a crafted package URL when registering or updating a function, source, or sink. The Functions worker validates the caller's rights only on the namespace where the component is being created, then retrieves the referenced package from the Packages Management Service using the worker's own broker credentials, so the package ACL is evaluated against the worker instead of the requesting user (CWE-863, confused deputy). Impact is limited to confidentiality - package code, business logic, or embedded credentials may be disclosed - with no modification, deletion, or availability effect; exploitation requires authentication/authorization and non-default package-management settings, and no public exploit was identified at time of analysis.
Path traversal in the comment-deletion handler of LeoMoon Studios wiki-go through 1.9.1 allows an authenticated wiki administrator to delete files outside the intended comments directory by supplying traversal sequences (such as ../, ..\, or URL-encoded %2e%2e) in the documentPath argument of the comment-deletion request. Because the endpoint is reachable remotely and requires no user interaction, a malicious or compromised admin account can remove arbitrary files writable by the wiki-go process, affecting integrity and availability (assessed CVSS:3.1 AV:N/AC:L/PR:H/UI:N/C:N/I:L/A:L); the file contents are not exposed. Publicly available exploit code exists and the flaw is described in a GitHub security advisory, but there is no indication of active exploitation in the wild. The issue is a genuine but modest-priority one, primarily constrained by the administrative-privilege prerequisite, and is fixed in version 1.9.2.
Memory exhaustion in pypdf versions prior to 6.21.0 allows unauthenticated remote attackers to cause denial of service by supplying a crafted PDF whose content stream contains a very large number of small operations. Default parsing in affected versions imposes no cap on array/dictionary element counts or total parsing work, so an application that reads untrusted PDFs can be driven to consume large amounts of memory; user interaction is required in the sense that a crafted PDF must be opened or processed. This is an availability-only issue rated 6.0 (CVSS 4.0, medium), and no public exploit code or confirmed active exploitation was identified in the provided data.
Memory exhaustion denial of service in pypdf versions prior to 6.21.0 allows an attacker-supplied PDF to drive parsing into unbounded memory consumption by embedding arrays or dictionaries with very large element counts. Only applications that actually ingest and parse untrusted PDFs through the library are exposed, since pypdf is a pure-Python component rather than a network service; no credentials are needed to craft or deliver the file (PR:N, UI:R/UI:P). The vendor has released pypdf 6.21.0 with configurable element-count and parsing-budget caps; no public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 4.0 base score is 6.0 (medium) with availability-only impact.
Denial of service in pypdf versions before 6.21.0 can be triggered when an application parses an attacker-crafted PDF and retrieves its form fields, causing excessive memory consumption or long runtimes through unbounded AcroForm field-tree traversal. The flaw is availability-only (CWE-400), requires the consuming application to accept untrusted PDFs and actually query form fields, and needs no authentication against the parsing code; no public exploit was identified at the time of analysis. The vendor has released pypdf 6.21.0, which adds limits on form-field entry count and traversal depth.
Authenticated low-privilege users of Velneo vServer can disclose server-side files readable by the vServer process through improper link resolution before file access, a symlink/link-following flaw. The issue affects vServer releases from 32.3 before 36.6 and from 37.1 before 37.2; exploitation requires a valid low-privileged account and a specific precondition to induce server-side path resolution of an attacker-influenced link. The vendor CVSS 4.0 base score is 6.0 and the independent assessment is moderate with confidentiality-only impact; no public exploit was identified at time of analysis, and a vendor patch is available through Velneo security advisories.
Path traversal in DT42 BerryNet through 3.10.2 lets low-privilege remote users read file metadata outside the intended model directory by supplying a crafted label to DLModelManager.get_model_meta. Exploitation requires valid low-level credentials and some user interaction, and the assessed impact is limited to low confidentiality disclosure with no integrity or availability effect. Publicly available exploit code exists, and no confirmed active exploitation is indicated in the provided intelligence.
Path traversal in the qwen-mtp-gguf conversion script within Jackrong-llm-finetuning-guide allows authenticated low-privileged remote attackers to manipulate the weight_map argument and direct file operations outside intended directories, but the victim must run the conversion pipeline. Impact is limited to low confidentiality and integrity effects with no scope change, and exposure is narrow because the affected code is a niche Qwen MTP-to-GGUF conversion utility; publicly available exploit code exists.
Cross-tenant run replay in Trigger.dev versions before 4.5.0 allows any authenticated tenant holding a valid API key to replay another customer's run into their own runtime environment and read the victim's task payload. The api.v1.runs.$runParam.replay route resolves runs by friendlyId alone without scoping the lookup to the caller's environment, so exploitation requires knowledge of the victim's specific friendlyId rather than being broadly enumerable. Impact is bounded to confidentiality (payload disclosure, no integrity or availability effect) and is most relevant in shared or multi-tenant hosted deployments; the vendor has released a fix in 4.5.0, and no public exploit code has been identified at time of analysis.
SQL injection in ProjectWorlds Advanced Library Management System 1.0 allows authenticated administrators to inject SQL through the firstname, middlename, lastname, address, branch, or type parameters in edit_member.php. The medium-severity flaw (CVSS 4.0 base 5.1; assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) primarily threatens library member data confidentiality and integrity, with limited availability impact, and requires a high-privilege session to exploit. Publicly available exploit code exists, though no CISA KEV entry confirms active exploitation at time of analysis.
Numeric literal manipulation in the Vyper smart-contract compiler (versions 0.1.0b1 through 0.1.0b16 and 0.4.1 through 0.5.0b1) lets attacker-supplied source silently alter address, integer, and decimal constants that survive into compiled bytecode. The compiler builds its source-line table with str.splitlines(), which recognizes line separators such as form feed (U+000C) and U+2028 that the Python parser ignores, so literals are classified and validated against a shifted view of the source. Exploitation requires a victim to compile and deploy malicious-looking-but-reviewed code (unauthenticated remote attacker, user interaction required per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), and no public exploit code or confirmed active exploitation has been identified at time of analysis; this is a medium-severity integrity issue, not an urgent remote-code-execution priority.
Source-code integrity compromise in the Vyper compiler allows attacker-supplied Vyper source to silently substitute numeric literals, addresses, and other constants during compilation. Affected versions are Vyper 0.1.0b1 through 0.1.0b11, 0.1.0b14, and 0.4.1 through 0.5.0b1; exploitation requires the victim to compile source containing either a non-ASCII identifier that NFKC-normalizes to ASCII or an invisible byte-order mark, which triggers a character-versus-byte offset mismatch in literal reconstruction. No public exploit code identified at time of analysis, and the flaw does not affect already-compiled trusted contracts or expose a remote network service.
Information disclosure in Splunk SOAR (on-premises) versions below 8.7.0 allows an unauthenticated remote attacker who already holds encrypted credential data from the instance to submit those values as HTTP Basic authentication to the REST API and have SOAR decrypt them before authentication checks complete. The vendor states this cannot be exploited at will because prior access to the encrypted credential store is required, and the CVSS 5.9 score (AC:H) reflects that precondition; no public exploit code or active exploitation is identified in the supplied data.
hMailServer 6.0.0 through 6.3.6 can be induced to forward or redistribute mail under an SMTP identity that satisfies the hosted domain's own SPF and DMARC checks, so a remote, unauthenticated attacker can write a message whose From names a domain the server hosts and have it delivered to outside receivers as DMARC-passing. The flaw is configuration-dependent: it requires a forward, Sieve redirect, alias or mailing list that carries hosted-domain mail to an external address, plus one of several additional conditions (SRS or envelope-sender rewriting enabled - both off by default - a list bounce address inside the domain's organization, a subdomain envelope sender whose SPF authorizes the server, or an empty envelope sender with an SPF-authorized hostname). Scored CVSS 5.9 (AC:H, no confidentiality or availability impact, high integrity impact); at time of analysis no public exploit code was identified, and the vendor addressed the issue in release 6.3.7.
TP-Link Archer C6 V2 routers use a device-universal hardcoded cryptographic key to protect exported configuration backups and stored credential data, so anyone who obtains such an encrypted artifact can decrypt it and recover plaintext administrative credentials. This is a moderate-severity confidentiality issue (CVSS 4.0 base 5.9; assessed CVSS 3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) because exploitation requires possession of the encrypted configuration file-typically after an administrative export, backup leak, support/RMA exposure, or prior compromise-rather than direct remote decryption. No public exploit has been identified at time of analysis, and TP-Link has released updated firmware for Archer C6 V2.
Domain spoofing in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have messages sent with an envelope sender at a domain the server hosts, bypassing SPF and DMARC checks at receiving systems. Exploitation depends on a pre-existing hosted account that collects mail from an external POP3/IMAP mailbox and forwards or redirects it to an outside address, and on the attacker knowing such a mailbox; the High attack complexity reflects that prerequisite rather than any authentication requirement. No public exploit code was identified and the issue was not listed in CISA KEV at time of analysis.
Unauthenticated remote attackers can force the Snort 3 Detection Engine in Cisco Secure Firewall Threat Defense, Cisco UTD Snort IPS Engine, and open-source Snort 3 to restart by sending crafted VBA data through traffic the engine inspects, producing a denial-of-service condition. The flaw is a stack-based buffer overflow (CWE-121) caused by improper range checking in the Snort 3 VBA Decompression Engine; exploitation requires Snort 3 inspection with VBA decompression enabled and visibility of attacker traffic. No public exploit was identified at time of analysis, and the assessed impact is limited to availability with a CVSS score of 5.8.
Antivirus attachment-stripping in Progressive Robot hMailServer 6.0.0 through 6.3.6 fails open, letting a remote unauthenticated sender have content the server's own virus scanner flagged as infected delivered unchanged into the recipient's mailbox. The bypass only triggers when virus scanning is enabled and the action is set to the non-default 'remove attachments and deliver the text' mode; messages crafted as a single non-text MIME part (a bare program or archive as the whole message, a whole forwarded message, a file declared as the sole attachment, or a one-part S/MIME-signed message) give the stripping routine no text part to isolate and are delivered as they arrived, leaving only an application-log line as evidence. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; practical harm additionally depends on the recipient's mail client opening the delivered content.
Memory management flaws in Cisco Snort 3's file-processing path allow remote, unauthenticated attackers to exhaust memory and force unexpected Detection Engine restarts, interrupting packet inspection on affected open-source Snort 3 and Cisco Secure Firewall Threat Defense deployments. The issue is rated CVSS 5.8 (moderate) with a scope change and availability-only impact; no public exploit was identified at time of analysis, and Cisco has published an advisory. Sustained delivery of files to an inspection point with file policy enabled is required, so exposure is greatest on inline sensors actively inspecting untrusted traffic.
Improper handling of nested GRE traffic in the Snort 3 Detection Engine allows unauthenticated, remote attackers to crash and restart the engine by sending a crafted GRE payload through an affected device, causing either an inspection bypass or a transient denial of service depending on how the device is configured. Affected deployments include Cisco Secure Firewall Threat Defense (FTD), the Cisco UTD Snort IPS Engine, Cisco Cyber Vision, the Cisco Umbrella Insights virtual appliance, and open-source Snort 3. No public exploit code or confirmed active exploitation was identified at time of analysis; the engine restarts automatically, so disruption is transient per triggering packet, keeping this a moderate-severity availability issue rather than a top-tier priority.