Affected HPE devices allow adjacent-network attackers to achieve high confidentiality and integrity impact without authentication or user interaction, per the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N; the exact product line, models, and software versions are not identified in the supplied data. The vuln.today decision label is act_now, but no CISA KEV entry or public exploit reference is present in the supplied intelligence, and no public exploit was identified at time of analysis. Security teams should treat the issue as high severity for devices reachable from Layer 2/adjacent segments while confirming affected product details through the HPE advisory.
An unauthenticated, low-complexity security flaw affects an as-yet-unnamed HPE product documented in HPE security bulletin hpesbnw05162, carrying a base CVSS 3.1 score of 9.3 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) and triaged as act_now. The only barrier to exploitation is network position: an attacker must sit on an adjacent Layer 2 segment, broadcast domain, or directly connected logical network, after which no credentials or user interaction are required and impact extends past the vulnerable component to a separate security authority with high confidentiality and integrity consequences. No public exploit code or proof-of-concept reference was identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); the specific triggering feature, protocol, or configuration is not described in the available sources, and no CWE has been assigned.
Unauthenticated attackers positioned on the same adjacent network segment can both read and modify data on affected HPE networking devices, according to CVE-2026-79873 (CVSS 3.1 base 9.3, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). The flaw requires no credentials and no user interaction and changes scope, meaning the attacker's control can extend beyond the vulnerable component, but the attack path is confined to the local LAN, VLAN, wireless, or management segment rather than being reachable from the open internet. No description has been published and no public exploit code has been identified at time of analysis; the vulnerability is not in CISA KEV, and the accompanying HPE advisory (hpesbnw05162en_us) is the authoritative source for affected models, trigger conditions, and fixes, which the reporting feed has tagged as involving information disclosure.
Man-in-the-middle interception and modification of NT OneAPP client-server communications is possible because the application fails to validate both the server certificate and hostname. Network-adjacent, unauthenticated attackers who already hold a position on the traffic path - such as a rogue Wi-Fi access point or compromised LAN segment - can present an arbitrary certificate and read or alter sessions. No public exploit was identified at time of analysis, and exploitation is bounded by the requirement to intercept live traffic; the independent assessment rates this as adjacent-network, high-complexity, with high confidentiality and integrity impact.
Command injection in Microsoft Azure Pipelines permits remote, unauthenticated code execution with high confidentiality and integrity impact, and the independent assessment also rates availability impact as high (CVSS base 9.1). The CPE identifies microsoft:azure_pipelines without a version restriction, and the available sources do not name the specific pipeline feature, input field, or deployment mode that carries the injectable parameter. A vendor patch is available; active exploitation is not confirmed by CISA KEV, although the CVSS temporal metric E:P indicates proof-of-concept exploit code is assessed to exist.
Arbitrary file read in Mistune's RST `.. include::` directive affects versions before 3.3.0: unauthenticated attackers able to submit markdown to a renderer with the Include plugin enabled can embed any file the rendering process can open - `/etc/passwd`, `/proc/self/environ`, an application's `.env`, `~/.aws/credentials` - into the rendered HTML via `../` traversal or an absolute path. The directive is opt-in: only integrations that register `RSTDirective([Include()])` and set `state.env['__file__']` are exposed, while default Mistune deployments and renderers that never set `__file__` are not affected. The GHSA advisory includes a proof-of-concept verified against mistune 3.2.1, and the flaw is fixed in 3.3.0.
SQL injection in mem0's Databricks vector store backend (mem0/vector_stores/databricks.py) affects versions 0.1.117 up to but not including 1.0.8, and lets remote unauthenticated attackers inject SQL that runs on the configured Databricks SQL warehouse by supplying crafted memory text, metadata values, or message names that reach unescaped string interpolation in the insert() and update() statements. Successful injection gives high confidentiality, integrity, and availability impact on the warehouse, though the assessed vector (AC:H/AT:P) indicates exploitation is not deterministic and requires the non-default Databricks backend to be configured; the trigger mechanics for reliably carrying a payload through mem0's ingestion pipeline are not described in the available sources. No public exploit code or CISA KEV entry was identified at time of analysis, the vendor has released the v1.0.8 fix, and the issue carries an act_now priority label with a CVSS 4.0 base score of 9.2.
Unauthenticated OAuth state values can be redeemed as Magic Link tokens in Better Auth 1.4.0-beta.18 through 1.7.6, letting an attacker who knows a victim's email address obtain a full session for that account without mailbox access or completing the provider callback. The flaw only applies to deployments that enable the Magic Link plugin with plain token storage (or hashed tokens plus globally hashed verification identifiers), enable a built-in social or Generic OAuth provider, and use database-backed OAuth state - the default when a database or secondary storage is configured. Successful abuse yields an existing user's session with all its permissions, or, when Magic Link sign-up is enabled, a new account incorrectly flagged as email verified; no public exploit code has been identified at time of analysis, but the vendor advisory and a public fix commit fully document the technique.
Hard-coded cryptographic key in the NT OneAPP login flow enables remote attackers to decrypt captured authentication requests and recover plaintext user credentials and device information. The issue affects NT OneAPP from NewType Infortech (CPE version wildcard, so all versions unless the vendor states otherwise); exploitation requires the attacker to first obtain encrypted login traffic, which is why the independent assessment rates attack complexity high despite the unauthenticated network vector. No public exploit was identified at time of analysis, and no CISA KEV entry is associated with this CVE.
Unauthenticated attackers who know a registered device's serial number can obtain that device's MDM client certificate and private key from OCO-Server's Apple MDM enrollment endpoint and then impersonate the device on all subsequent MDM traffic. The /api-mdm.php/profile handler verifies enrollment plists with openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...), so an arbitrary self-signed certificate satisfies the check and the SERIAL/UDID claims in the payload are trusted without being bound to the signer; the response returns a PKCS#12 bundle containing a certificate with CN=<serial> issued by the server's internal MDM device CA together with its private key, and the victim's mobile_device row is overwritten with the attacker-chosen UDID. Affects OCO-Server 1.2.0 through 1.2.2 (the MDM feature was introduced in 1.2.0); version 1.2.3 fixes the issue. Reported by GitHub_M and rated act_now by vuln.today priority; no public exploit identified at time of analysis, active exploitation is not confirmed, and the reporter states a proof of concept and full reproduction evidence were offered privately under coordinated disclosure.
Server-side template injection in Drupal Webform (CWE-1336) allows code injection, with the independently assessed impact rated high for confidentiality, integrity, and availability. The independent assessment identifies Webform 0.0.0 through 6.2.11 and 6.3.0 as affected, with vendor-fixed releases 6.2.12 and 6.3.1. No public exploit was identified at the time of analysis and EPSS is low at 0.22%, but the vuln.today decision is act_now because of the high severity.
Argument injection in Incus 7.3.0 through 7.4.x lets a user confined to a restricted project smuggle the forbidden block.create_options setting onto a custom volume, then trigger a copy or move onto a storage pool that formats new volumes, so the injected value is appended to the mkfs command line executed as root. The flaw is an incomplete fix for CVE-2026-62867, which only rejected the option on the direct custom-volume creation path while leaving update, copy and move operations unchecked; the package range is go/github.com/lxc/incus/v7/cmd/incusd >= v7.3.0, < v7.5.0. Exploitation requires an authenticated restricted-project user with permission to create or edit custom volumes, and root-level code execution only materialises on pools that format on copy such as non-thin LVM - on other drivers the forbidden option lands on the volume config without reaching mkfs. No public exploit code was identified at time of analysis, but the weakness class is straightforward and the priority signal is act_now given the root-level outcome on affected storage backends.
Missing authorization in OpenRemote's GatewayServiceResource lets any authenticated, non-administrative user start, stop, or query edge-gateway tunnels, opening persistent bidirectional TCP circuits into an edge gateway's network or tearing down tunnels operators depend on. All OpenRemote deployments from 1.2.0 through versions before 1.31.0 are affected, but exposure is gated on the instance actually using gateway tunneling with at least one configured edge gateway, since the vulnerable POST/DELETE tunnel endpoints must be reachable and operational. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the attacker only needs a low-privileged account (CVSS PR:L) and no user interaction, which keeps the bar low wherever tunneling is deployed.