Privilege escalation through SQL injection in on-premises Arista VeloCloud Orchestrator lets any valid VCO account cross into operator-level access and impersonate the built-in superuser operator, reaching internal-only functions and potentially compromising the orchestrator host and managed data. The vendor rates the issue CVSS 9.4; hosted and Dedicated VCO deployments were affected and are reported already patched, so on-prem VCO is the remediation focus, and the supplied priority label is act_now. No public exploit identified at time of analysis, and no CISA KEV status is supplied in the provided intelligence.
Remote code execution in GitLab CE/EE can be triggered by a specially crafted regular expression processed through a vulnerable compilation path, potentially allowing an unauthenticated network attacker to run arbitrary code on the GitLab server. The flaw is an integer overflow (CWE-190) affecting a broad version range from 7.0 through 19.5.1; exploitation is conditional on reaching the relevant regex-compilation functionality, and our assessment rates attack complexity as high despite the advisory CVSS of 10.0. Publicly available exploit code exists, but no CISA KEV designation is indicated in the provided data.
An OS command injection flaw (CWE-78) in the network management service of affected Kiloview E3 NDI encoder firmware lets a user who holds the static-route configuration permission inject arbitrary operating system commands that execute as root. Exploitation requires an authenticated web management account with route-configuration rights (CVSS PR:H), and the injected route configuration persists across reboots, so a successful attacker gains durable root-level control of the device, with potential exposure of stored credentials and cryptographic material. The vendor directs users to its latest E3 firmware download and CISA has published advisory ICSA-26-295-01; no public exploit code or confirmed active exploitation is identified in the available sources, though the vuln.today decision label is act_now.
Authenticated command injection in Kiloview E3 NDI encoder firmware allows a web user who can configure network settings to execute arbitrary operating system commands as root via the link maintenance address configuration endpoint. Affected firmware is listed as versions from 0 to below 1.30; no public exploit was identified at time of analysis, and a vendor firmware update is available.
Authenticated command injection in Kiloview E3 NDI encoder firmware before 1.30 allows a low-privileged web user to execute arbitrary OS commands as root through the device naming endpoint, resulting in full device compromise. The vendor has released firmware 1.30 and CISA published ICS advisory ICSA-26-295-01; no public exploit was identified at time of analysis. The flaw is rated high priority (act_now) and requires only valid low-privileged credentials plus network access to the web interface.
InterSystems IRIS for Health ships with TLS/SSL encryption turned off by default, so traffic between clients and the superserver can traverse the network in cleartext and be read by anyone positioned on that path. Unauthenticated remote attackers who can observe or intercept the traffic (an on-path requirement reflected by AT:P in the CVSS 4.0 vector) may capture transmitted data, including credentials that can subsequently be reused to log into the device. No public exploit code has been identified at time of analysis, but exploitation is constrained by the interception prerequisite and is neutralized where operators have enabled TLS per the InterSystems securing checklist; the flaw was reported by ICS-CERT in advisory ICSMA-26-295-01 and carries an act_now priority label.
A maximum-severity, network-reachable flaw (CVSS 3.1 base 10.0) in an as-yet-unnamed HPE product allows remote attackers to achieve high confidentiality, integrity and availability impact across a scope boundary without authentication or user interaction. The affected product line, feature, protocol and version range are not stated in the available data; the only authoritative source is HPE security bulletin hpesbnw05162en_us, which must be consulted to identify the exact product and fixed build. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the vulnerability is tagged 'Information Disclosure' while the assessed vector also scores high integrity and availability impact, so the true impact profile should be confirmed from the vendor bulletin. Vuln.today priority is act_now based on the assessed vector.
Unauthenticated network attackers can potentially achieve high confidentiality, integrity, and availability impact against an HPE networking product, based on the supplied CVSS 3.1 vector scoring 10.0 with scope change. The CVE has no description and no published affected version range; the HPE Security Bulletin hpesbnw05162en_us is the only reference, and the exact product feature, deployment mode, and trigger remain unverified. No public exploit is identified at time of analysis.
HPE security bulletin hpesbnw05162en_us documents a maximum-severity (CVSS 10.0) exposure in an HPE product that is not named in the available data, so the specific affected platform and version range remain unresolved. The assessed vector describes unauthenticated, network-reachable exploitation at low complexity with no user interaction and a changed scope, meaning impact is judged capable of reaching beyond the vulnerable component to give high confidentiality, integrity and availability loss. A single source tag labels the issue as information disclosure, which does not fully reconcile with the High integrity and availability ratings in the vector; no CVE description, CWE, CPE data, KEV entry or public exploit reference was supplied, so active exploitation is not confirmed and no public exploit was identified at time of analysis. The vuln.today priority decision is act_now, driven by the maximum severity score rather than by corroborated in-the-wild activity.
HPE advisory hpesbnw05162en_us covers a product flaw carrying a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning remote, unauthenticated access with no user interaction and full confidentiality, integrity, and availability impact across a scope change. The affected product, versions, and trigger are not stated in the supplied data and must be confirmed from the bulletin; no CISA KEV entry was supplied and no public exploit was identified at time of analysis, though the vuln.today decision label is act_now.
Unauthenticated remote attack against an HPE networking product carries the vendor's maximum CVSS 3.1 base score of 10.0, reflecting network reachability with low complexity, no privileges and no user interaction, a scope change, and high confidentiality, integrity and availability impact. The HPE bulletin referenced as hpesbnw05162en_us is the only source supplied: no description, CWE, CPE, version range or fixed-version information was provided, so the specific affected product line, exposed interface and trigger remain unconfirmed. No public exploit code was identified at time of analysis, and CISA KEV status is not indicated, but the single-source nature of this record means the product and version scope must be confirmed directly against the advisory before exposure can be judged.
HPE's security bulletin hpesbnw05162en_us covers a maximum-severity flaw (CVSS 3.1 base score 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) in an HPE networking product that remote, unauthenticated attackers can reach with no user interaction and low attack complexity; the scope-change metric means the impact can cross the vulnerable component's security boundary, with high confidentiality and integrity loss and no availability impact scored. The exact product, version range and exposed feature are absent from the available intelligence - no CPE, no CWE and no description were supplied - so the affected deployment must be identified from the HPE advisory itself. No public exploit identified at time of analysis: there is no CISA KEV entry and no PoC or exploit reference in the supplied data, while the vuln.today priority decision is act_now and the report originates from HPE's own security-alert mailbox.
Information disclosure in an unspecified HPE Networking product is tracked as CVE-2026-79844, but the supplied record contains no CVE description, CWE, CPE, or affected-version data, so the exact component at risk is unconfirmed. The independent assessment rates the issue as network-reachable, low-complexity, unauthenticated, and no-interaction, with high confidentiality impact and no integrity or availability impact; the source's 10.0 score is broader and is not adopted by that assessment. vuln.today assigns an act_now priority, while no CISA KEV status is present and no public exploit identified at time of analysis.
HPE networking products are affected by a high-severity issue (CVSS 9.8) tracked as CVE-2026-79857, with a remote, unauthenticated vector (AV:N/AC:L/PR:N/UI:N) and high confidentiality, integrity, and availability impact. The CVE record contains no description, CWE, CPE, or version data, and the supplied tag labels it as information disclosure; the exact feature and affected configurations are not described in the available sources. No KEV designation or public exploit code is present in the supplied intelligence, so no public exploit was identified at time of analysis, but the vuln.today decision label is act_now and the HPE advisory hpesbnw05162en_us is the authoritative source for scope and fixes.
HPE networking equipment is affected by a CVE with no published description, but its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes unauthenticated network-reachable access with high confidentiality, integrity, and availability impact. The supplied tag says Information Disclosure, while the vector indicates broader impact; the affected feature, protocol, and exact models are not identified in the available data. No public exploit was identified at time of analysis; HPE bulletin hpesbnw05162en_us is the only remediation reference, and the vuln.today decision is act_now.
Privilege escalation in Microsoft VM Inspector for Azure Virtual Machines allows unauthenticated, network-reachable attackers with no user interaction to gain elevated privileges, and the vendor scores it CVSS 10.0 with a scope change (S:C) indicating impact extends beyond the initially vulnerable component. The root cause is a link-following defect (CWE-59): the component resolves a link before accessing a file, so an attacker who can influence a symbolic link or junction can redirect privileged file operations. Microsoft has published a fix through its MSRC update guide and the vuln.today priority is act_now; no public exploit code or CISA KEV entry was identified at time of analysis.
Privilege elevation in Azure Kubernetes Configuration Service is possible for unauthenticated network attackers because a critical function lacks authentication, and the CVSS 3.1 base score is 10.0. Because the service is Microsoft-managed, real-world exposure depends on network reachability to the vulnerable endpoint and on whether Microsoft has already completed server-side remediation; no customer-side non-default configuration is stated as required. Vendor patch information is available and the vuln.today priority label is act_now; no public exploit identified at time of analysis.
Improper authentication in Microsoft Entra Application Proxy (formerly AAD App Proxy) allows an unauthenticated, remote attacker to elevate privileges across a trust boundary, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) scoring 10.0 - no privileges, no user interaction and low complexity, with high confidentiality and integrity impact and a scope change. Exposure is deployment-specific: the target organization must actually run Application Proxy to publish internal applications for remote access, and the proxy endpoint must be reachable by the attacker; organizations not using the service are not exposed to this flaw. Microsoft is the reporting party and a vendor patch is available per the MSRC update guide, and the vuln.today decision label is act_now; no public exploit code or confirmed active exploitation was identified in the supplied data, although the trigger conditions themselves are not described in the available sources.
Unauthenticated remote code execution in YOOtheme Pro 5.0.0 through 5.0.52 allows a remote attacker to reuse a request signature disclosed in a legitimate public image URL, inject image operations, traverse out of the cache directory, and write an attacker-controlled PNG/PHP polyglot into a public media directory. Joomla sites running the affected extension with the image-transformation handler reachable are at risk, and code execution depends on the media directory being PHP-executable; no account or user interaction is required. No public exploit is identified in the supplied intelligence at time of analysis, but the priority decision is act_now.
Privilege escalation to proxy administrator with follow-on arbitrary command execution affects the LiteLLM proxy server (AI Gateway) from 1.87.0 up to the fixed releases 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0-rc.2. An authenticated account holding internal_user privileges can submit crafted metadata through the API-key creation flow so the proxy encrypts and returns a forged administrator credential, then replay that ciphertext as a bearer token to be trusted as a proxy admin and run commands via the MCP stdio endpoint. Versions after 1.91.0 are vulnerable in the default configuration, while 1.87.0 through 1.90.x are only exposed when EXPERIMENTAL_UI_LOGIN=true is explicitly set; CVSS 3.1 scores this 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), the priority label is act_now, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated, network-reachable compromise of an HPE networking product is described by HPE security bulletin hpesbnw05162en_us, which is scored CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - meaning an attacker who can reach the affected interface needs no credentials and no user interaction, and the impact spans confidentiality, integrity and availability. The supplied record contains no CVE description, no CWE and no CPE, so the specific product line, deployment mode and version range cannot be named from the available data; the vendor bulletin must be consulted to determine exactly which devices and firmware are in scope. Only a single reference (the HPE advisory) is available, no EPSS score or CISA KEV listing was supplied, and no public exploit has been identified at time of analysis, although the vendor-priority signal for this record is act_now. Note the record-level tag 'Information Disclosure' is narrower than the assessed vector, which rates integrity and availability impact as high as confidentiality.
Unauthenticated remote compromise of HPE networking products is described by a maximum-severity CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), a profile that implies full loss of confidentiality, integrity and availability from a network-reachable position with no privileges and no user interaction. The only substantive source is the HPE Security Bulletin hpesbnw05162en_us; the CVE record itself carries no description, no CWE mapping and no CPE data, so the vulnerable service, required configuration and affected version range cannot be confirmed from the supplied material. No CISA KEV entry and no public exploit code were identified at time of analysis, although the item is triaged act_now; the supplier-supplied tag reads 'Information Disclosure', which may point to a narrower real-world impact than the full-CIA vector suggests, and that discrepancy is unverified.
Unauthenticated, network-reachable exploitation of an HPE networking product carries a CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning an attacker with only network access could achieve high confidentiality, integrity and availability impact without credentials or user interaction. The only source in the supplied intelligence is the HPE security bulletin hpesbnw05162en_us; no CVE description, CWE, CPE, affected version list or fixed-version information was provided, so the specific vulnerable component and the trigger conditions are not described in the available sources. The vuln.today decision label is act_now, and no KEV listing or public exploit code was identified at time of analysis, though the bulletin itself could not be retrieved to confirm either signal. The supplied tag reads 'Information Disclosure', which is narrower than the assessed high impact on all three security pillars and should not be relied on as a description of scope.
HPE products covered by Security Bulletin hpesbnw05162 carry a critical-severity (CVSS 9.8) flaw reachable over the network, and vulnerability intelligence flags it as an act-now item, yet the affected component, configuration, and version range cannot be named from the supplied data. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U vector with C:H/I:H/A:H means exploitation would require only network reachability to the affected service, with no authentication and no user interaction, against whatever deployment is ultimately confirmed applicable. The record is tagged Information Disclosure, which sits awkwardly against a vector scoring full integrity and availability impact, so the actual impact class should be confirmed from the bulletin before it is relied upon. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so no confirmed active exploitation exists; the trigger itself is not described in the available sources.
A critical-severity flaw (CVSS 9.8) affects an unspecified HPE product per an HPE security advisory (hpesbnw05162en_us), allowing network-reachable, low-complexity attacks that require no authentication or user interaction and can fully compromise confidentiality, integrity, and availability. The available intelligence contains no CVE description, no CWE classification, and no product or version detail, so the precise vulnerable component and trigger cannot be confirmed; the single NVD reference resolves to the HPE support advisory, which must be consulted for the authoritative affected-product list. No public exploit or active-exploitation reporting is included in the supplied data, but the internal decision label is act_now, so treat remediation as immediate and verify exposure against the vendor advisory before assuming any deployment is unaffected.
Remote, unauthenticated exploitation of an HPE networking service carries a vendor-scored CVSS 9.8 critical impact: low-complexity network access with no user interaction can affect confidentiality, integrity and availability at high severity. The supplied intelligence provides no CVE description, CWE, CPE or version range, so the exact product feature, configuration and trigger remain unconfirmed and must be established from HPE bulletin hpesbnw05162en_us. An 'Information Disclosure' tag is the only mechanism clue; no CISA KEV status is included and no public exploit identified at time of analysis, while the vuln.today decision is act_now.
HPE networking equipment carries a maximum-severity CVSS 9.8 rating under a CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector, meaning a network-reachable attacker without credentials or user interaction could fully compromise confidentiality, integrity and availability. The CVE record itself ships with no description, no CWE and no CPE data, and the only reference is an HPE support document (hpesbnw05162en_us), so the specific product line, firmware branch, exposed protocol and version range cannot be confirmed from the available sources. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, yet the vuln.today priority label is act_now - urgency signals therefore conflict with the absence of confirmed exploitation activity, and the HPE advisory should be treated as the authoritative source before scoping exposure.
Remote, unauthenticated attackers can achieve full confidentiality, integrity, and availability impact against an affected HPE networking product, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The specific vulnerable component, protocol, and affected version range are not described in the available sources; HPE published only a support bulletin (hpesbnw05162en_us) and no CVE description or CWE mapping was supplied, and the record carries an Information Disclosure tag that is difficult to reconcile with the full impact triad. No CISA KEV listing, no public exploit code, and no EPSS score were provided, but the vuln.today priority decision is act_now, so treat exposure as urgent pending confirmation from the HPE bulletin.
Authentication bypass by spoofing in Brainstorm Force's SureCart WordPress plugin affects versions through 4.9.5 and, per the CVSS vector, is reachable over the network without authentication or user interaction, with high confidentiality, integrity, and availability impact. The exact spoofing mechanism and any required configuration are not described in the supplied sources, and no public exploit was identified at time of analysis. The vuln.today priority is act_now.
Heap-based buffer overflow in AiDot Linkind Matter Smart Plug firmware 1.01.32 allows unauthenticated attackers positioned on the same local network segment to corrupt heap memory through crafted SSDP header parsing, with high confidentiality, integrity, and availability impact. The vendor-facing CVSS of 9.8 uses AV:N, but the independently assessed vector is AV:A because SSDP is a local-discovery protocol-internet exploitation requires a prior LAN foothold or an exposed or forwarded UPnP service on UDP port 1900. No CISA KEV entry or verified working exploit code is present in the supplied data; a public GitHub repository documents the SSDP/UPnP issues, and EPSS is low at 0.19% (8th percentile).
Local file inclusion in the CozyThemes Rootblox WordPress plugin through 1.0.6 allows remote attackers to read files accessible to the web server and, if executable PHP can be placed in an includable location, potentially execute code. The supplied CVSS 3.1 vector rates this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and the vuln.today decision label is act_now, but the description does not identify the plugin feature, endpoint, or parameter that controls the include path, and the PR:N/UI:N requirement comes only from the Patchstack CVSS rather than independent confirmation. No public exploit identified at time of analysis; installations running versions after 1.0.6 are outside the stated affected range.
Command injection in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets remote attackers execute shell commands by manipulating the FileMd5 argument handled by UploadCustomModule in lib/cste_modules/product.so. The supplied CVSS 4.0 vector scores it as unauthenticated network exploitation with no user interaction, though practical reachability depends on exposure of the router management service on the LAN, or on the WAN if remote management is enabled. Publicly available exploit code exists, and impact is constrained to this specific model and firmware build.
HPE networking devices are exposed to a critical-severity (CVSS 9.6) adjacent-network flaw that requires no authentication and no user interaction. The bulletin is tagged Information Disclosure, while the assessed vector indicates high confidentiality, integrity, and availability impact with a scope change; the exact triggering feature or protocol is not described in the available sources. No public exploit identified at time of analysis, and the vuln.today decision label is act_now pending review of HPE bulletin hpesbnw05162en_us.
HPE networking devices carry a CVSS 9.6 flaw that an unauthenticated attacker on the same adjacent or local network segment can use without user interaction; the changed-scope vector (S:C) indicates the impact can cross a security boundary, with high confidentiality, integrity and availability consequences. The affected models, firmware branches and the exact protocol or feature involved are not described in the available sources, so scope must be confirmed against HPE bulletin hpesbnw05162en_us, which is the only reference supplied. Exploitation has not been publicly demonstrated: no public exploit code and no CISA KEV listing was provided, and no EPSS score was supplied, although the vuln.today priority label is act_now, so the exposure should be treated as requiring prompt action pending vendor details.
A critical-severity (CVSS 9.6) unauthenticated flaw affects an unspecified HPE product, reported directly to the vendor by security-alert@hpe.com and tracked in HPE advisory hpesbnw05162en_us. An attacker positioned on an adjacent network segment (same broadcast/L2 domain, VLAN, or wireless network) can trigger it without credentials or user interaction, resulting in scope-changed high impact to confidentiality, integrity, and availability. The vuln.today Decision label is act_now; because no CVE description was published, the specific triggering feature, protocol, and exact affected versions must be taken from the HPE advisory, and no public exploit code or CISA KEV entry is indicated in the available data.
Critical-severity exposure in HPE networking devices (CVSS 9.6) can be triggered by an unauthenticated attacker on an adjacent Layer-2 segment, with high confidentiality, integrity, and availability impact and scope change extending effects beyond the vulnerable component. The only supplied vendor reference is HPE bulletin hpesbnw05162en_us, and no CVE description, CWE, CPE string, or exact affected model/firmware is provided; the report is tagged Information Disclosure even though the CVSS vector scores all three impact categories high. The vuln.today decision label is act_now, and no KEV status, EPSS score, or public exploit code was supplied, so no public exploit is identified at time of analysis.
HPE networking devices are exposed to a critical, unauthenticated attack from an adjacent network position, with the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicating low-complexity exploitation that can produce high confidentiality, integrity, and availability impact and may extend to other systems through changed scope. HPE's own security team reported the issue via advisory hpesbnw05162en_us, and the vuln.today decision label is act_now. No CISA KEV entry or public exploit reference appears in the supplied intelligence, so no public exploit is identified at time of analysis; the supplied tag says Information Disclosure, but the assessed vector indicates impacts well beyond confidentiality alone.
An attacker positioned on an adjacent network can achieve high confidentiality, integrity and availability impact against an affected HPE networking device, reflected in a 9.6 CVSS base score from the vector AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. No authentication and no user interaction are required once the attacker is on the same Layer-2 segment, VLAN or broadcast domain, and the scope-change metric means the compromise can affect resources beyond the vulnerable component itself; the limiting factor is purely the adjacency requirement, so arbitrary internet-side attackers are not in the threat model. No public exploit code has been identified at time of analysis, EPSS and KEV data were not supplied, and the single reference is an HPE support advisory; the vulnerable feature or protocol and the exact trigger are not described in the available sources.
Full-scope confidentiality, integrity, and availability compromise of affected HPE networking devices is possible for an unauthenticated attacker positioned on the same adjacent network (CVSS 9.6, AV:A/AC:L/PR:N/UI:N/S:C). The CVE record supplies no description, CWE, CPE, patch version, KEV status, or exploit reference, so the specific feature and affected models cannot be confirmed from the provided data; the HPE bulletin is the only source carrying product-level detail. No public exploit identified at time of analysis, but the act_now priority label and changed-scope high-impact vector justify urgent validation against that bulletin.
High-impact compromise of affected HPE networking devices is possible for unauthenticated attackers who obtain adjacent-network access in CVE-2026-79869 (CVSS 9.6). The assessed vector is AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, so no credentials or user interaction are needed once the attacker is on the same local or logical network segment, and the scope change plus full confidentiality, integrity and availability impact make this an act_now priority. No public exploit is identified at time of analysis, and the provided sources do not describe the product-specific trigger.
High-severity (CVSS 9.6) compromise of HPE networking devices is possible from an adjacent-network position: an unauthenticated attacker on the same LAN segment, VLAN, or directly attached network can trigger the flaw with low complexity and no user interaction, and the changed-scope impact is rated high for confidentiality, integrity, and availability. The source tag labels this as Information Disclosure, while the assessed vector also scores high integrity and availability impact; the specific triggering feature or protocol is not described in the supplied sources. HPE's bulletin is the sole reference, no public exploit is identified at time of analysis, and the vuln.today priority is act_now.
HPE networking products are affected by a CVSS 9.6 scope-changing flaw (CVE-2026-79867) tagged as information disclosure but assessed with high confidentiality, integrity, and availability impact. Exploitation requires adjacent-network positioning with no authentication and no user interaction, while affected models and firmware versions are not enumerated in the supplied data. The priority label is act_now; no CISA KEV entry or public exploit reference was supplied, so no public exploit is identified at time of analysis.
Pre-boot remote code execution in the TianoCore EDK II PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) lets an unauthenticated network attacker corrupt DXE-phase memory on any machine that is PXE-booting over IPv4 or IPv6, writing attacker-controlled bytes past the fixed 504-byte Mode.IcmpError field in the driver's private context. The reliable outcome is a DXE-core exception and hang that denies OS provisioning or recovery; escalation to arbitrary ring-0 code execution before Secure Boot or measured boot has verified anything requires the attacker to know the exact target firmware build so a counterfeit event can be planted for CoreSignalEvent() dispatch. No CISA KEV entry and no public exploit code were identified at time of analysis, but the vuln.today decision label is act_now and this is a genuine high-priority issue because the vulnerable receive path is open by default during network boot.
Arbitrary file write in Incus (before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0) allows an authenticated client permitted to create instances or custom volumes, or a malicious migration source server, to plant symlinks such as rootfs pointing at / in an incoming volume so rsync or btrfs receive writes attacker-controlled files as root on the target host, leading to full host compromise. All rsync-based storage drivers and the optimized btrfs path are affected, while optimized ZFS transfers are not; a symlink check added in 7.3 runs after the transfer and does not prevent the writes. The vuln.today priority is act_now, and no public exploit identified at time of analysis.
Path traversal in Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 allows an authenticated client with permission to create instances to write root-owned directories and attacker-controlled files at arbitrary host paths by importing a crafted instance backup whose index.yaml lists a dependent custom volume with ../ sequences, creating a route to full host compromise. The flaw bypasses the name validation added for CVE-2026-81495 and CVE-2026-81496 because the dependent-volume path reaches volume creation through a different code path, and the attached-device gate can be satisfied by splitting the traversal across the pool and source fields. No public exploit code or CISA KEV entry was identified at time of analysis, but the vendor advisory and an act_now priority decision indicate urgent remediation; CVSS is 9.4.
Stack buffer overflow in Wasmtime (39.0.0 through 48.0.3, and 49.0.0 through 49.0.1) lets a malicious guest component write roughly 16KB of attacker-chosen data onto the host process's native stack by supplying a mistyped component-model-async callback result type, allowing return-address overwrite that can crash the host or, per the vendor, should be treated as a sandbox escape / arbitrary code execution risk. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope change from guest to host and requires the low-privileged guest to be able to deliver a component to the runtime; embedders that only run trusted components, or that build without the component-model-async feature, are not exposed. No public exploit code has been identified at time of analysis, but the vendor rates this as a genuine high-priority issue requiring immediate patching to 48.0.4 or 49.0.2.
A critical-severity (CVSS 9.4) flaw affects an as-yet-unnamed HPE networking product, exposed through a network-reachable interface that remote attackers can reach without authentication or user interaction (AV:N/AC:L/PR:N/UI:N), with high confidentiality and integrity impact and a lesser availability impact. The only public reference is HPE advisory hpesbnw05162en_us, and no CVE description, CWE classification, or CPE data was supplied, so the affected product family, version ranges, and the specific interface involved remain unconfirmed. Third-party triage assigns this an act_now priority, but no public exploit code and no CISA KEV entry are associated with the record at time of analysis, so the urgency rests on the severity vector and the vendor's own security-alert notification rather than on observed exploitation.
SQL injection in the TMS Amelia booking plugin for WordPress, affecting versions through 2.4.11, lets remote attackers influence SQL queries in the plugin, with the authoritative assessment emphasizing high confidentiality impact and lower integrity and availability impact. The vulnerable endpoint or parameter is not disclosed, and the provided data contains no public exploit code or CISA KEV entry. The reported CVSS is 9.3, while the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, indicating network-reachable, unauthenticated exploitation with no user interaction once a vulnerable Amelia installation is present.
HPE networking devices are affected by a CVSS 9.3 flaw that an unauthenticated attacker on an adjacent network can trigger without user interaction, producing high confidentiality and availability impact while integrity impact is rated none; the supplied data does not name the affected feature, protocol, or trigger condition. The independent assessment identifies adjacent-network reachability of the HPE device as the key gating prerequisite, and the vuln.today decision label is act_now. No KEV listing or public exploit reference is present, so no public exploit is identified at time of analysis, and the overall signals remain mixed and incomplete.
Affected HPE devices allow adjacent-network attackers to achieve high confidentiality and integrity impact without authentication or user interaction, per the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N; the exact product line, models, and software versions are not identified in the supplied data. The vuln.today decision label is act_now, but no CISA KEV entry or public exploit reference is present in the supplied intelligence, and no public exploit was identified at time of analysis. Security teams should treat the issue as high severity for devices reachable from Layer 2/adjacent segments while confirming affected product details through the HPE advisory.