SmileCDR HAPI FHIR can be driven into heap exhaustion and service crashes by unauthenticated attackers who submit highly compressed payloads that are expanded during server-side decompression. The CVSS:4.0 score of 8.7 (assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) reflects an availability-only impact: no confidentiality or integrity loss, no privileges or user interaction required, but a high availability hit against network-reachable FHIR endpoints that decompress untrusted input. No public exploit code has been identified at the time of analysis and the CVE is not listed in CISA KEV; the vuln.today decision label is this_week, so treatment should be scheduled in the current patch cycle rather than treated as an emergency, and deployed instances that accept compressed request bodies should be prioritized.
Unauthenticated remote attackers can crash an Erlang node running the Dropbox esaml SAML library (versions 0.1.0 and later) by sending a crafted SAMLResponse to the SAML assertion-consumer (ACS) or single-logout (SLO) endpoint. Because esaml_binding:decode_response/2 hands the decoded XML to xmerl_scan:string/2 before any signature check, every distinct element name, attribute name, and namespace prefix in the document is interned as a permanent Erlang atom; a few dozen requests carrying documents with thousands of unique names exhaust the roughly one-million-entry atom table and abort the VM. The CNA rates this CVSS 4.0 at 8.7, while independent assessment aligns with a CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - pure availability impact with no confidentiality or integrity loss; no public exploit code was identified at time of analysis and there is no CISA KEV listing, though the flaw is trivially reachable by anyone who can POST to a SAML endpoint.
Remote unauthenticated attackers can exhaust server CPU by submitting markdown with deeply nested square brackets to Mistune 3.0.0 through 3.2.1, where the parse_link_text helper degrades to quadratic time and a roughly 16KB payload can occupy a worker for over a minute. Impact is availability-only with no confidentiality or integrity effect, and exposure is bounded by whether an endpoint actually passes untrusted markdown to mistune. A public proof-of-concept reference exists in the upstream advisory; it is not verified as working exploit code, there is no CISA KEV entry, and the this_week decision label reflects a credible but non-emergency priority.
An authorization bypass in Netmaker through 1.7.0 lets an authenticated user who holds external-client permissions on just one network reach into external clients belonging to other networks by sending PUT requests to /api/extclients/{network}/{clientid} - replacing public keys, disabling clients and retrieving WireGuard private keys. The CVSS 4.0 score of 8.7 reflects network reachability, low complexity, high confidentiality and integrity impact with only low privileges required (PR:L) and no user interaction, and the unscoped lookup is present in default deployments rather than needing special configuration. No public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data, and the upstream fix is carried in PR #4153 / commit 332d8b9.
SQL injection in Lotus through 0.10.2 lets authenticated organization users read and modify the shared multi-tenant database by embedding crafted SQL in billable metric property_name or categorical filter values, which are rendered unescaped into Jinja-generated counter, gauge and rate queries. Exploitation requires a valid account with metric-configuration access (PR:L) but no victim interaction; the CVSS 4.0 score is 8.7. No CISA KEV entry is present, and no working exploit code is confirmed in the supplied sources.
HPE networking equipment is affected by a high-severity flaw (CVSS 3.1 base 8.7) that a privileged, authenticated attacker can reach over the network with no user interaction, resulting in high integrity and availability impact that extends beyond the vulnerable component itself (S:C) while leaving confidentiality unaffected (C:N). Only attackers who already hold high privileges (PR:H) on the affected product can realistically trigger it, so exposure is concentrated among insiders and adversaries who have already established a privileged foothold rather than unauthenticated internet scanners. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; HPE has published an advisory under hpesbnw05162en_us, and the vendor's own notification lists the issue as an information-disclosure-class concern.
Privilege escalation in the Grav Login plugin (3.6.0 before 3.9.13) allows page authors to obtain super-user accounts by defining an invitation form in page frontmatter and submitting the login.invite task without authentication. The missing authorization check requires an existing authenticated page-author foothold (PR:L) to plant the invitation form, so it is not exploitable by a fully anonymous outsider; no public exploit code or CISA KEV entry was identified at time of analysis. This is a credible, actionable privilege-escalation issue rather than a drop-everything remote-root flaw.
Symlink-following arbitrary file write in the JetBackup plugin for WordPress (versions before 3.1.24.10) allows an authenticated WordPress administrator to write attacker-chosen file contents outside the intended restore destination by importing a crafted backup archive that contains a symbolic link. Because the extraction routine follows the link without validating targets or enforcing destination containment, the write can land in a security-relevant location and, where the server configuration permits execution there, escalate to server-side code execution. The administrator-level privilege prerequisite (CVSS PR:H) is the main limiter on exposure; exploitation requires no victim interaction beyond the attacker's own use of the import/restore feature, no public exploit was identified at time of analysis, and the vendor has released a fixed version (3.1.24.10).
Path traversal and cross-site scripting in Mistune through 3.2.0 allow unauthenticated remote attackers to read files outside the intended source directory and inject HTML/script into rendered output when the optional Include directive plugin is enabled and untrusted markdown is processed. The flaw is not reachable in default configurations because the Include plugin must be explicitly added via the plugins parameter; where enabled, ../ sequences in include paths escape the source directory, and error messages and included file contents are emitted without HTML escaping even with escape=True. No public exploit identified at time of analysis, and the vendor-released fix is Mistune 3.3.0.
XML external entity injection in Apache Abdera (all versions) allows unauthenticated remote attackers to read sensitive data or trigger server-side requests when an application feeds attacker-controlled XML into Abdera's parser or JDBC adapter parsing paths. The project is retired and unsupported, so Apache states it will not issue a fix, and downstream products that still bundle the Abdera artifact remain exposed. No public exploit identified at time of analysis, and exploitation is deployment-dependent: the target must still embed Abdera and route untrusted XML to it.
SQL injection in the Lotus (uselotus/lotus) metering and billing platform through 0.10.2 lets an authenticated organization-level user smuggle SQL into usage-aggregation queries by registering a crafted subscription_filter_key that passes the keyword-only validator and is later rendered as an unquoted GROUP BY identifier. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the dominant impact is high-confidentiality disclosure of billing and usage data held in the shared multi-tenant database, with limited integrity impact and no availability effect; the reporter's CVSS 4.0 vector scores it 8.7. No CISA KEV entry or confirmed working exploit code was identified at time of analysis, though a public technical writeup is referenced, and vuln.today sequencing places this in the this-week remediation queue - the practical prerequisite is a valid tenant account on a deployment where aggregation queries span tenants.
SQL injection in the Lotus billing platform through 0.10.2 allows an authenticated organization-level user to execute arbitrary stacked SQL statements through POST /app/metrics/, enabling cross-tenant reads and modifications of data in the shared database. The weakness bypasses first-statement-only validation because semicolon-appended statements are executed unfiltered. Exploitation requires a legitimate tenant account and access to the custom billable-metric query feature; no public exploit has been identified at time of analysis.
SQL injection in JSON-SCADA releases before 0.65-alpha lets an authenticated user inject arbitrary SQL through the OPC historian HistoryRead API implemented by opcApi() in src/server_realtime_auth/index.js, by supplying crafted NodeId.Id, StartTime or EndTime values in a HistoryReadRequest. Because stacked statements are accepted, an attacker with any valid account can read, modify or delete historian data across all locations irrespective of their assigned role, giving high confidentiality, integrity and availability impact to the historian. Exploitation requires network reach to the HistoryRead endpoint plus valid credentials (CVSS 4.0 PR:L, aligned with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code is identified at time of analysis, the issue is not in CISA KEV, and VulnCheck reporting places remediation in the current weekly patch cycle rather than an emergency response.
Roskus Prospero Flow CRM versions 2.0.0 through 5.25.x ship user API routes (GET and DELETE /api/user/{id}) protected only by the auth:api middleware, which validates the JSON Web Token and performs no permission, policy or role check, so any holder of a basic-role account can read the account records of other users in the same company - including administrators and their email address, telephone number, postal address and IBAN - and, from 3.5.0 onward, delete those accounts. Exploitation requires a valid authenticated account (PR:L) and, for deletion of accounts outside the attacker's own company, membership in Company::DEFAULT_COMPANY (company ID 1), where the company comparison is skipped entirely; an account in that company can delete any account of any company, including a company's last administrator, and deletion removes the data held on the account. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vulnerability is tracked with an assessed CVSS 3.1 base of 8.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and is prioritized for remediation this week.
Cross-tenant conversation-state leakage in the Strands Agents SDK A2A server allows an authenticated remote caller in a multi-tenant deployment to read other tenants' conversation history and plant persistent instructions that alter model behavior for subsequent callers by referencing a different context_id. Python strands-agents before 1.43.0 and TypeScript @strands-agents/sdk before 1.5.0 are affected; single-tenant or single-user deployments are not exposed. No public exploit was identified at time of analysis, and fixes are available in 1.43.0 and 1.5.0.
Cross-site scripting in the Agent Zero Web UI before 1.15 allows injected JavaScript in chat messages or uploaded files to run inside a victim's authenticated session when Agent Zero renders that content back in the chat interface. The flaw is unauthenticated from the attacker's side (PR:N) but depends on a victim viewing the rendered content (UI:R), and impact is confined to the victim's Web UI session (VC:H/VI:H, no assessed scope expansion to other systems); Agent Zero 1.15 and later sanitize chat markdown and are not affected. The vendor shipped a fix in v1.15, the issue is tracked as CWE-79 and catalogued as EUVD-2026-108272, and no confirmed public exploit code appears in the supplied sources, although the advisory cites a GitHub issue report for the bug.
Cross-tenant data access in SmileCDR HAPI FHIR allows an attacker who holds valid credentials for one tenant in a multi-tenant deployment to read from or write to another tenant's storage partition by submitting an untrusted bundle body that replaces a trusted partition identity; storage partition entitlement is not enforced by default. Exploitation requires authenticated access to at least one tenant, and single-tenant deployments or those with partition entitlement enforcement enabled are less exposed. No public exploit identified at time of analysis, and this is a genuine priority rather than an inflated high-CVSS issue, though not a drop-everything emergency.
Authentication bypass in Obot's CLI login flow before 0.26.0 lets an unauthenticated remote attacker obtain a victim's non-expiring API key by choosing a token request ID and persuading a signed-in user to complete the crafted login link, resulting in account takeover. The flaw is a CSRF-class weakness (CWE-352) requiring user interaction, and the stolen key remains valid until manually revoked. No public exploit code was identified at time of analysis, and CVE-2026-114662 is not in CISA KEV.
Vyper compiler releases 0.4.0b1 through 0.5.0b1 can miscompile contracts that import an unfoldable constant or a function with an omitted default argument and then declare a parameter, local, or loop variable with the same name, causing the imported name to resolve in the using function's scope instead of at its declaration. When that name collision exists, attacker-influenced input can replace the intended value, including an out-of-range value for a narrow type such as uint8, corrupting validation or accounting logic. The independent assessment stresses that this is not exploitable against a default or arbitrary Vyper contract, that exploitation requires the specific import-and-shadowing source pattern in an affected beta compiler, and that no public exploit was identified at the time of analysis; the supplied CVSS 4.0 vector is PR:N, but the assessed CVSS 3.1 vector treats the issue as high-complexity and integrity-focused.
Mail header injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows any authenticated mailbox user to inject arbitrary MIME part headers into an outgoing message by placing CRLF sequences in the media type of an inline-image data URI, rated CVSS 8.5 with high integrity impact and changed scope. The flaw sits in rcmail_sendmail::extract_inline_images(), which used the attacker-controlled media type without validation; exploitation needs the standard HTML compose feature and no victim interaction, but it is not available to unauthenticated remote attackers. The vendor has released fixed versions, and there is no public exploit identified at time of analysis.
OS command injection in the Terraform hook of AWS SAM CLI (sam build --hook-name terraform) lets an actor who can influence the Terraform configuration or plan file consumed by a build execute arbitrary commands as the build user on the build host. The flaw affects versions 1.63.0 through 1.166.1; the hook inserted the Terraform resource address of each SAM metadata resource into a shell command while neutralizing only double-quote characters, so a crafted resource address containing shell metacharacters (such as command substitution syntax) was passed through unmodified. No privileges on the host are required (PR:N) and no AWS credentials are needed, but the build must be invoked by a user (UI:A) and the target must actually use the Terraform hook build mode with attacker-influenceable Terraform input, so exposure is limited to builds consuming untrusted or compromised third-party modules, shared repositories, or plan artifacts; no public exploit code was identified at time of analysis, and the risk is a conditional supply-chain/build-time one rather than a mass-exploitable network flaw.
Blind SQL injection in AmentoTech Workreap Core before 3.4.4 allows an authenticated low-privileged user to extract data from the WordPress database; the risk picture is moderate and somewhat conflicting because exploitation requires a plugin account rather than anonymous access. No public exploit was identified at time of analysis, and the specific vulnerable endpoint or parameter is not described in the supplied sources.
Arbitrary code execution in CleanShot X for macOS occurs when the application insecurely deserializes data embedded in a .cleanshot project file, so a crafted editable-screenshot annotation file runs its payload automatically during parsing in the context of the logged-in user. The flaw affects users on release branches below the fixed builds 4.5.2, 4.6.3, 4.7.8 and 4.8.10, and exploitation is gated by mandatory user interaction: the attacker must deliver the malicious file and convince the victim to open it, with local file delivery rather than a network-exposed service. No public exploit code has been identified at time of analysis, and the CERT-PL-sourced report is tracked as a this-week priority rather than an emergency; users who have never opened a .cleanshot file from an untrusted source are explicitly out of scope.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 accepts SVG and EPS files for contact photo uploads and passes them to ImageMagick for resizing, allowing authenticated users to supply content that can reference external resources or invoke ImageMagick delegates; this may lead to file disclosure, SSRF, or command execution depending on the server's ImageMagick configuration. No public exploit has been identified at time of analysis, and vendor patches are available in 1.6.20 and 1.7.5.
Project isolation bypass in Incus lets an authenticated client that is confined to one project copy and read custom storage volumes belonging to any other project on the same server, including volume snapshots and configuration. The flaw affects Incus 7.0.1 (fixed in 7.0.2) and 7.2.0 through 7.4.x (fixed in 7.5.0), and is reachable only through a hand-crafted POST to /1.0/storage-pools/{pool}/volumes/custom that supplies a source volume with an attacker-chosen source.project while omitting source.type - the official Incus client always sets source.type=copy and therefore cannot trigger it. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires legitimate low-privilege credentials holding can_create_storage_volumes in at least one project, so impact is concentrated on multi-project servers where project isolation is the actual security boundary.
CVE-2026-79881 is a high-severity (CVSS 8.3) network-reachable flaw in an HPE product, documented only through the vendor bulletin referenced as hpesbnw05162en_us, which is the identifier format HPE uses for its networking/Aruba security bulletins; the specific product, version range and trigger are not stated in the supplied data. Per the assessed vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), no prior authentication is needed, but successful exploitation requires the target user to perform an action and depends on high-complexity conditions that are not fully under the attacker's control, with a scope change implying impact beyond the initially vulnerable component. Intelligence tags the issue as Information Disclosure, which sits awkwardly with the vector's high confidentiality, integrity and availability impacts - that inconsistency, combined with the absence of a description or CWE, means the real-world impact cannot be verified from the available sources; no public exploit has been identified at time of analysis and there is no CISA KEV entry. The vulnerability is queued under a 'this_week' priority label rather than an emergency/act-now designation.
Information disclosure in HPE network devices, with the exact affected model and firmware not identified in the supplied data, allows attackers on an adjacent network segment to read sensitive data and cause limited integrity and availability impact without authentication or user interaction. The CVSS 3.1 score is 8.3, with the vector requiring same-segment access (AV:A) rather than internet-wide reachability, low attack complexity, no privileges, and no user interaction. No public exploit or CISA KEV entry is identified at time of analysis, and the specific triggering feature is not described in the available sources.
Information disclosure affecting an HPE product line that has not been named in the supplied data can be triggered by an attacker positioned on the adjacent network, with the assessed vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, 8.3) indicating high confidentiality, integrity and availability impact that crosses a security scope boundary. No authentication or user interaction is required, but high attack complexity means success depends on conditions outside the attacker's direct control, and exposure is confined to the same broadcast domain or a logically adjacent segment rather than the public Internet. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; the report originates from HPE's own security alert channel and priority guidance places remediation in this week's window, yet no CVE description, CWE mapping, CPE inventory, or fixed version has been supplied, leaving HPE bulletin hpesbnw05162en_us as the only authoritative reference.
Signals point to a real but bounded availability risk rather than a top-tier emergency: the MongoDB C# Driver's BSON library interns every BsonSymbol produced during deserialization and retains those symbols for the lifetime of the process with no cap, so an unauthenticated remote party able to get attacker-influenced BSON or JSON deserialized can drive unbounded memory growth and deny service to the host application (availability-only; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CNA CVSS 4.0 score 8.2). Exposure is conditional - the application must actually deserialize untrusted content through the driver and that content must carry BSON symbol values; merely having the driver installed is not a trigger, and no MongoDB server component is affected. No public exploit code or confirmed active exploitation has been identified at time of analysis; version 3.13.0 removes symbol interning as the fix.
Unauthenticated remote denial of service in the Erlang SAML library esaml (0.1.0 and later) allows an attacker to abort an Erlang node by exhausting its atom table through unsigned LogoutResponse messages posted to a Service Provider's single-logout endpoint. Because esaml_sp:validate_logout_response/2 only verifies a signature when one is present, an unsigned message reaches esaml:decode_logout_response/1, where status_code_map/1 converts each unrecognized StatusCode into a permanent atom with list_to_atom/1 - roughly one million distinct status values (the VM's default atom-table ceiling) are enough to crash the node. The CNA scored this CVSS 4.0 8.2 with the AT:P attack-requirement metric; the practical barrier is volume and time rather than skill, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in the MQTT5-to-MQTT 3.1.1 compatibility adapter of AWS aws-c-mqtt (versions 0.9.1 through 0.16.1) allows a hostile or impersonated MQTT broker to trigger an excessive memory allocation that crashes the client process, and the crash can recur if the application automatically restarts and reconnects. Exploitation requires that the application uses the compatibility adapter and either connects to an attacker-controlled broker or has its broker traffic tampered with on-path (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/A:H; vendor CVSS 4.0: 8.2 with AT:P). No public exploit identified at time of analysis and no CISA KEV listing; the vendor-released fix is aws-c-mqtt 0.16.2, also bundled in aws-crt-cpp v0.43.9 and AWS IoT Device SDK for C++ v2 v1.45.1.
Improper authentication in the Go event-ingestion middleware of uselotus Lotus through 0.10.2 lets unauthenticated remote attackers submit usage events to POST /api/track/ on behalf of another organization, corrupting that tenant's metered usage and billing records. The flaw is integrity-only (no data disclosure or availability impact) and exploitation hinges on knowing or obtaining a valid API key prefix, since the secret half of the key is never compared against the stored hashed_key; the sources do not explain how a prefix would be leaked or enumerated. No public exploit code was identified at time of analysis and the vulnerability is not in CISA KEV, though VulnCheck reporting and a public technical writeup give the issue a this_week remediation priority; the blast radius is narrow but the defect is a genuine authentication bypass.
HPE networking products are affected by a remotely reachable, unauthenticated flaw rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:H), where the dominant risk is loss of availability with a limited integrity impact rather than the exposure of data. The single supplied source - HPE security bulletin hpesbnw05162en_us - is the only authoritative record of which platforms and firmware revisions are in scope, because no CVE description, CPE mapping, or version range was included in the intelligence feed. No public exploit code or PoC reference was identified at time of analysis, and the issue has not been added to CISA KEV; it carries a this_week priority label, so remediation should be scheduled within the current patching cycle rather than treated as an emergency.
Remote, unauthenticated attackers can cause high availability impact and limited integrity impact against an HPE networking product, per a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) published with HPE bulletin hpesbnw05162en_us. No description, CWE, CPE or version data accompanied the CVE record, so the specific product line, interface, protocol and affected release range are not identified in the available sources and must be confirmed from the HPE bulletin. No public exploit code and no confirmed active exploitation are indicated at time of analysis, and the issue is prioritized as 'this_week' rather than an emergency, but the vector describes a low-complexity, no-prerequisite network attack path that warrants prompt confirmation of exposure.
Cross-origin WebSocket access in webpack-dev-server before 5.2.7 and in 6.0.0 lets a malicious web page, visited by a developer while the dev server runs, reach a proxied backend through the dev server without Host or Origin validation. The gap exists only when a devServer.proxy entry is configured with ws:true, and it bypasses the allowedHosts checks that already block the same route over plain HTTP-even if the server is bound to loopback. No public exploit identified at time of analysis; the vendor fixed the issue in 5.2.7 and 6.1.0.
Information disclosure in HPE networking devices allows unauthenticated attackers on the same adjacent network segment to obtain high-confidentiality data, with the CVSS 3.1 base score of 8.2 reflecting changed scope, no integrity impact, and low availability impact. The exact affected models, firmware versions, and trigger conditions are not described in the available sources; HPE bulletin hpesbnw05162en_us is the sole reference for scope and remediation. No public exploit code was identified at time of analysis.
Crafted HTTP requests sent to Next.js App Router applications that define at least one Server Action can drive excessive CPU consumption and block processing of further requests in the same Node.js process, producing a denial of service rated 8.2 (CWE-770, uncontrolled resource allocation). The affected ranges are 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0; applications on the Pages Router, and App Router applications with no Server Actions defined, are explicitly not vulnerable, which substantially narrows the exposed population. Exploitation requires no authentication and no user interaction, and no public exploit code has been identified at time of analysis, with no CISA KEV entry and no EPSS signal supplied; the vendor states that upgrading to 15.5.28 or 16.4.1 is the only complete fix, with no workaround available.
Information disclosure in HPE networking products, tracked as CVE-2026-79891, can expose sensitive data to remote unauthenticated attackers when a high-complexity condition outside their direct control is satisfied; the CVE record is scored 8.1, while the independent assessment limits impact to confidentiality only. The affected product family, versions, feature, and exact prerequisite are not exposed in the supplied data, and the only vendor pointer is HPE security bulletin hpesbnw05162en_us. No public exploit was identified at time of analysis, and no CISA KEV status is present.
HPE has published advisory hpesbnw05162en_us for a network-reachable flaw tracked as CVE-2026-79887 that, per its CVSS 3.1 vector (8.1 High), can fully compromise confidentiality, integrity, and availability of the affected system. The specific product, version range, CWE class, and the precondition implied by the high attack complexity (AC:H) are not stated in the available input, so the exact feature or configuration an attacker must arrange remains unconfirmed and must be read from the HPE advisory. No CISA KEV listing, no public exploit code, and no EPSS score were supplied at time of analysis; the single-source tag labels the issue 'Information Disclosure', which is narrower than the total-impact vector and should be reconciled against the vendor advisory. Prioritization signal from vuln.today places this in the 'this_week' queue rather than act_now or emergency.
Information disclosure in HPE Networking products (CVE-2026-79890) has a CVSS 3.1 base score of 8.1; the assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H describes remote, unauthenticated exploitation with no user interaction, while high attack complexity means success depends on conditions outside the attacker's full control. The affected HPE product, version range, and required configuration are not described in the available sources and must be confirmed from HPE bulletin hpesbnw05162en_us, and the tag only classifies the issue as Information Disclosure. No public exploit identified at time of analysis, and the vuln.today priority label is this_week; signals are mixed and the underlying data is thin.
An 8.1-severity remote flaw (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) affects an HPE networking product identified only through HPE security bulletin hpesbnw05162en_us; the specific product and version ranges are not present in the supplied data. Scoring combines full impact on confidentiality, integrity and availability with network reachability, no privileges and no user interaction, but high attack complexity means a condition outside the attacker's control must hold before exploitation succeeds, and that prerequisite is not described in any available source. No public exploit code and no confirmed active exploitation (CISA KEV) are associated with this record, and the only cited reference is the HPE bulletin itself; the vuln.today triage label is this_week, so this should be scheduled within the current patch cycle rather than treated as an emergency. Note the supplied tag reads "Information Disclosure" while the assessed vector claims high integrity and availability impact - that discrepancy is unresolved in the available data.
High-severity network-reachable compromise of the HPE product covered by bulletin hpesbnw05162en_us can affect confidentiality, integrity, and availability, though the available data provides no public description of the flaw. The CVSS 3.1 vector rates it 8.1 with AV:N/AC:H/PR:N/UI:N, so unauthenticated remote exploitation with no user interaction is possible only when unspecified high-complexity preconditions are met. No public exploit code or CISA KEV entry is identified, and the HPE advisory is the authoritative source for affected versions and fixes.
Unauthenticated PHP local file inclusion in the Elated-Themes Academist Core plugin for WordPress (all versions through 1.4.1) lets a remote attacker steer an include/require statement toward files already present on the server, exposing their contents and, depending on what is included, influencing executed code - scored CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector requires no authentication and no user interaction, but AC:H reflects conditions the attacker does not fully control (such as a resolvable local path or a particular request state), which limits reliable or automated exploitation. Reported by Patchstack and prioritized as 'this_week'; no public exploit code or CISA KEV entry was identified at time of analysis, and the specific endpoint, parameter and feature that trigger the inclusion are not described in the available sources.
Path traversal in Kiloview E3 firmware allows an authenticated user of the device management interface to supply a crafted time-zone value that redirects /etc/localtime outside the intended zoneinfo directory. Exploitation requires network access plus valid credentials, is rated high complexity, and is limited to confidentiality impact; this is a medium-severity issue (CVSS 5.3) rather than a top-tier emergency. No KEV confirmation is present in the supplied intelligence, and no public exploit identified at time of analysis.
Server-side request forgery in Azure AI Foundry can be exercised by an authenticated user with low privileges over the network, allowing the service to be induced to make requests that may expose sensitive information and cross a scope boundary. The affected product is Microsoft's Azure AI Foundry cloud service; no public exploit was identified at the time of analysis and no KEV designation is present in the supplied data, while Microsoft has published a vendor fix. This is a genuine but moderate-priority issue rather than a drop-everything emergency, and the exact feature, API, or request parameter that triggers the server-side request is not described in the available sources.
Local privilege escalation is possible in the affected HPE networking product, where a low-privileged local user can achieve high confidentiality, integrity, and availability impact with low attack complexity and no user interaction (CVSS 3.1: 7.8 High). The flaw cannot be triggered remotely and requires prior local access; the specific feature, protocol, or configuration that triggers it is not described in the available sources. No public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation.
Unauthenticated visitors can overwrite a machine-translation configuration value in the Infility Global WordPress plugin before 2.16.25, because an AJAX action exposed to logged-out users performs no authorization or nonce check (CWE-862). The impact is integrity-only and low: no confidentiality or availability effect is described, and the affected setting belongs to a companion Infility Global plugin. Severity is low (CVSS 3.7; assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the vendor has released 2.16.25, a public PoC reference exists but is not verified as working exploit code, and the vuln.today decision label is monitor.
HAProxy 3.x releases before 3.4.6 can be driven into persistent denial of service by remote unauthenticated attackers sending a single crafted HTTP/1.1 chunked request: the H1 multiplexer's chunk parser re-processes the same bytes without advancing, pinning one worker thread at 100% CPU even after timeouts fire and the client disconnects. Repeating the request exhausts the worker pool until the process is manually restarted, so confidentiality and integrity are unaffected but availability is fully lost. Attack surface is standard HTTP/1.1 frontend traffic (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-835); no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the upstream fix commit is published in the HAProxy git repository.
Identity impersonation in the MongoDB C#/.NET Driver allows one application user to execute database operations under another user's X.509 identity, affecting the confidentiality and integrity of everything that identity can reach. The driver's shared connection cache keys TLS client certificates only by issuer and serial number, so a user who copies a victim certificate's issuer and serial into their own certificate - without holding the victim's private key - can be handed a cached connection already authenticated as the victim. The flaw requires a specific multi-tenant architecture where one host application builds multiple clients from per-user certificates while sharing a connection pool; there is no public exploit identified at time of analysis, but the underlying patch is shipped in version 3.13.0.
A truncated HTTP/2 PING frame sent to an HAProxy frontend that accepts HTTP/2 causes the H2 multiplexer to spin in a busy loop, driving worker-thread CPU to saturation and degrading or denying service to legitimate traffic (CVSS 7.5, availability-only). Only deployments with an HTTP/2-enabled listener (h2 in the bind line / ALPN negotiation) are reachable; HTTP/1.x-only setups are unaffected, and no authentication or user interaction is required against an H2 endpoint. Sustained impact depends on the attacker holding many concurrent connections open, since each connection is eventually cleared by 'timeout http-request'; no public exploit code was identified at the time of analysis and there is no KEV confirmation of active exploitation.