An out-of-bounds read (CWE-125) exists in Tencent RapidJSON up to and including 1.1.0, reachable through the library's Regex Parser component when the templated GenericStringStream<UTF8<char>>::Take function in include/rapidjson/stream.h is exercised; a successful trigger reads memory adjacent to the intended buffer, producing partial information disclosure and/or a crash rather than code execution. Exposure is conditional: because RapidJSON is a header-only C++ library with no network surface of its own, only applications that pass attacker-influenced data into the regex/schema validation path inherit the flaw - deployments that never use regex or schema functionality are not exposed. A public PoC reference exists (upstream GitHub issue #2401); it is not verified as working exploit code, and there is no CISA KEV entry, though SSVC records exploitation status as 'poc' and the EPSS score of 0.30% (23rd percentile) reflects low predicted exploitation activity.
Price and title tampering in SourceCodester Online Food Ordering System 1.0 allows remote attackers to alter submitted order values because order.php trusts client-side price/title fields instead of revalidating them server-side. The CVSS 4.0 score is 5.5 with PR:N in the vector, but the independent assessment notes that reaching the order workflow may in practice require a customer session, so that prerequisite should be verified; overall it is a genuine but low-severity issue, not an emergency. No CISA KEV entry is present, EPSS is 0.30% (23rd percentile), and a public PoC reference exists; it is not verified as working exploit code.
Unauthenticated SQL injection in the contact form handler (contact_insert.php) of oretnom23's PHP Travel Agency System allows remote attackers to inject arbitrary SQL through the name, company, email, topic, phone and comments parameters, which the code feeds into database queries without sanitization. The project is a small demo/tutorial-grade codebase with a correspondingly limited deployment footprint, and the reported impact is Low across confidentiality, integrity and availability. A public PoC reference exists in the project's GitHub issue tracker; it is not verified as working exploit code, and there is no CISA KEV entry or other confirmation of active exploitation, with EPSS-type urgency reflected only in a this_month priority label.
SQL injection in the admin record pages of oretnom23's PHP Travel Agency System lets remote attackers inject arbitrary SQL through the costomer_id, ticket_id, emp_id, salary_id and page_id parameters of admin/customer_detail.php. The product is distributed as source with no tagged releases; the European advisory lists affected snapshots at commits b58513f8371d098650fac656001bf8f59f795d25, 4e28b8f84d72420373dd15c3ae32900beb7e0635 and 2592d60d8f2c6e199f02c828c6d6fbc7b5298c96, and the wildcard CPE implies all versions are presumed affected. A public PoC reference exists (the upstream issue report) but it is not verified as working exploit code; the maintainer was notified via that issue and has not responded, so no fixed version is available and the priority is assessed as this_month.
SQL injection in the admin/customer_search.php search page of oretnom23's php-travel-agency-system allows remote attackers to manipulate the customer_name, voucher_no and emp_name parameters and alter the SQL query the page builds, giving low-impact reads and writes against the backend database. The CVSS 4.0 score is 5.5 (Medium) with all vulnerable-system impacts rated Low, and the supplied vector marks PR:N, although the endpoint sits under the admin/ directory, so whether an administrative session is required in practice is unresolved and should be verified per deployment. A public PoC reference exists (the upstream GitHub issue) but it is not verified as working exploit code; there is no CISA KEV entry, the project was notified early via that issue report and has not responded, and the vendor has not released a patch.
OS command injection in the desmondmorris node-tesseract npm library (versions 0.2.0 through 0.2.7) allows remote attackers to execute arbitrary shell commands when a consuming application passes unsanitized input into the 'image' argument of the process() function in lib/tesseract.js, because the Command Builder concatenates that value into the Tesseract OCR shell invocation. The package is not exploitable in isolation: reachability, authentication requirements and real-world impact depend entirely on the host application that exposes the image parameter to untrusted input. A public PoC reference exists in the project's GitHub issue tracker; it is not verified as working exploit code, and no vendor fix has been released because the maintainer has not responded to the report.
A remote out-of-bounds write in Hitachi's JP1 operations-management suite lets an unauthenticated network attacker corrupt memory in affected JP1 service processes, with the vendor-assigned CVSS 3.1 score of 9.4 reflecting high confidentiality and integrity impact and a partial availability impact (AV:N/AC:L/PR:N/UI:N). Affected are JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition from 13-00 before 13-50-31, and JP1/Base from 11-00 before 12-50-54. Hitachi has released fixed versions, no public exploit code or KEV entry was identified at time of analysis, and EPSS is modest at 0.46% (39th percentile), though the vuln.today decision signal is act_now given the unauthenticated network vector and memory-corruption class.
Stack-based buffer overflow in Hitachi HiRDB Server allows remote, unauthenticated attackers to corrupt memory and potentially execute code, with high confidentiality and integrity impact. The affected ranges are Version 10 from 10-00 before 10-12-01 and Version 9 branches - including 9(32) and Additional Function variants - from 09-00/09-02 through 09-66-22 or 09-66/V. Hitachi has released fixed versions; EPSS is 0.45% (39th percentile), no public exploit was identified at time of analysis, and vuln.today priority guidance is act_now despite the conflicting urgency signals noted in the independent assessment.
Stack-based buffer overflow in Hitachi JP1/AJS3 Manager (versions 10-00 before 13-50-31) could let remote, unauthenticated attackers trigger memory corruption with high confidentiality and integrity impact and limited availability impact (CVSS 9.4). The vendor CVSS vector is AV:N/AC:L/PR:N/UI:N, so no credentials or user interaction are required, but the sources do not identify the specific network interface or input that reaches the vulnerable code. No public exploit identified at time of analysis and EPSS is low at 0.45% (39th percentile), while a vendor fix is available in 13-50-31.
Heap-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 - Manager (versions 10-00 through builds prior to 13-50-31) is reachable over the network with no authentication or user interaction required under the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), giving a worst-case impact of high confidentiality and integrity loss plus limited availability impact (CVSS 9.4). No public exploit code or CISA KEV entry is associated with the issue, and EPSS is low at 0.45% (39th percentile), yet the vuln.today decision label is act_now, driven by the maximum-severity, pre-authentication, network-reachable profile against an enterprise job-scheduling manager; the notable tension is that low observed exploitation likelihood sits alongside a maximum-severity rating and the absence of a published trigger description. The vendor has released a fix, and deployments on 13-50-31 or later are not affected.
Stack-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 - Manager (versions from 10-00 up to but not including 13-50-31) gives remote, unauthenticated attackers who can reach the manager service a memory-corruption primitive that the CVSS 3.1 vector rates at 9.4 with high confidentiality and integrity impact and limited availability impact. No privileges and no user interaction are required per CVSS:3.1/AV:N/AC:L/PR:N/UI:N, and the concrete service, protocol or malformed input that overflows the stack buffer is not described in the available sources. No public exploit has been identified at time of analysis and the EPSS score is low (0.45%, 39th percentile); the act_now priority label is driven by the unauthenticated network-reachable attack surface rather than by observed exploitation. Vendor-released patch: 13-50-31.
Stack-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 allows remote, unauthenticated attackers to corrupt memory over the network with no user interaction, potentially compromising confidentiality and integrity and causing limited availability impact (CVSS 9.4). Hitachi reports affected Manager and Agent branches from 11-00 before 13-50-31, while EUVD also maps 10-00 branches and Agent Minimal Edition 11-50 to versions below 13-50-31. A vendor patch is available; no public exploit was identified at time of analysis (EPSS 0.45%), and CISA KEV does not list this CVE.
Heap-based buffer overflow in Hitachi JP1/Automatic Job Management System 3 Manager, Agent, and Agent Minimal Edition before 13-50-31 can be reached over the network without authentication or user interaction under the vendor CVSS vector (CVSS 9.4, AV:N/AC:L/PR:N/UI:N), yielding high confidentiality and integrity impact and low availability impact. Hitachi has released fixed version 13-50-31, and the vuln.today priority is act_now. No CISA KEV entry or public exploit code was identified at time of analysis; EPSS is 0.45% (39th percentile), so the priority reflects severity and network exposure rather than observed exploitation.
Heap-based buffer overflow (CWE-122) in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager, Agent and Agent Minimal Edition (13-00 before 13-50-31), and JP1/Base (11-00 before 12-50-54), rated CVSS 3.1 9.4 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - remote, low-complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact. The vulnerability is unauthenticated per the PR:N vector, and the specific service, port, or crafted input that triggers the overflow is not described in the available sources. Hitachi has released fixed versions (13-50-31 for the 13-00 branch products, 12-50-54 for JP1/Base), there is no CISA KEV entry or confirmed exploitation, and no public exploit was identified at time of analysis; EPSS is 0.45% (39th percentile) - the main real-world limiter is whether the JP1 service is network-reachable by an attacker.
Stack-based buffer overflow in Hitachi JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 (Manager, Agent, and Agent Minimal Edition) 13-00 through 13-50-30, and JP1/Base 11-00 through 12-50-53 lets remote unauthenticated attackers corrupt stack memory, carrying high confidentiality and integrity impact alongside a lower availability impact (CVSS 3.1 base 9.4, AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis and EPSS is low at 0.45% (39th percentile), but the vendor-reported severity and the absence of any privilege or user-interaction prerequisite place this at act_now priority for the listed versions. Vendor-released fixes exist: 13-50-31 for all 13-00 JP1 branches and 12-50-54 for JP1/Base.
Legacy WebRTC input handling in Neko 3.0.0 through 3.1.4 incorrectly treats an authenticated room member as a host, allowing that member to inject mouse and keyboard events through the legacy data channel even while controls are locked or the member lacks authorization under the modern control API. Only deployments running legacy mode with session.implicit_hosting enabled are exposed; the modern HTTP/WebSocket control path enforces authorization correctly and is not affected. The flaw is rated CVSS 3.1 5.4 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), no public exploit code was identified at time of analysis, and the vendor has released a fix in v3.1.5.
Unauthenticated handling of FireCluster Sync traffic in WatchGuard Fireware OS lets an attacker who already holds a position on the cluster interconnect - a compromised cluster peer or an on-path attacker on the synchronization network - invoke privileged firewall management actions as root with a single crafted request, with no credentials or user interaction required. The flaw affects the Fireware OS 12.0 branch before 12.12.4, the 2025.1 branch before 2026.4, and the 12.0 branch before 12.5.22; Fireboxes that are not running FireCluster are not exposed through this path, which together with the typically isolated nature of the cluster interconnect is the main gating factor on real-world risk. Vendor patches are available on all three branches, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-reported CVSS of 9.4 and adjacent-network reachability warrant prompt remediation on clustered deployments.
Unauthenticated attackers can forge valid administrator JSON Web Tokens against nest-admin before 1.0.1 because the JWT signing secret (and the refresh-token secret) is committed to the repository as the fixed placeholder value 'admin!@#123'. Any deployment still running with the shipped .env.production or .env.development secret is fully compromised: an attacker signs a token asserting any user ID or the admin role, and JwtStrategy and RbacGuard accept it without further checks, yielding complete confidentiality, integrity and availability impact (CVSS 4.0 base 9.3, assessed CVSS 3.1 9.3, CWE-321). No public exploit code has been identified at time of analysis, although the key material itself is publicly readable in the project's Git history; VulnCheck assigns an 'act_now' priority, and the sole limiting factor is whether an operator replaced the committed secret with an independent strong value. The vendor fixed the issue in 1.0.1 and states that any environment that ever ran with the historical default must rotate both secrets and reissue all sessions after upgrading.
Unauthenticated SQL injection in the Balbooa Gridbox extension for Joomla before 2.20.4.2 allows remote attackers to inject into the ORDER BY clause via the sort-by parameter on store product list pages and extract database contents. The issue requires a published Gridbox store/product listing page to be reachable but no authentication or user interaction, and the independent assessment limits impact to confidentiality (C:H/I:N/A:N). EPSS is modest at 0.39% (32nd percentile), yet the priority decision is act_now; no public exploit identified at time of analysis.
Sunhillo SureLine deployments running versions 8.0.0 through below 9.1.5 accept session cookies that contain nothing but a cleartext username, letting an unauthenticated remote attacker impersonate a logged-in user and chain that access into root command execution through networkDiag.cgi. The main limiting prerequisite is that the targeted account must already hold an active web session at attack time, and default account names such as Admin or sftp_user make the username guesswork trivial. The vendor has released SureLine 9.1.5 as the fix and prioritization guidance marks this as act_now; no CISA KEV listing or verified working exploit code is present in the available data.
Missing authorization in the Balbooa Gridbox extension for Joomla (versions 1.0.0 through 2.20.4.1) allows unauthenticated remote requests to invoke the EditorController::getBlogPosts() task and read blog-post data without the edit-level check applied to other controller tasks. The supplied CVSS 4.0 score is 9.3 with high confidentiality, integrity, and availability impact, but the independent assessment is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so the demonstrated impact should be treated as unauthorized blog-post read or exposure rather than data modification or denial of service. No public exploit was identified at time of analysis; EPSS is 0.32% (24th percentile), the fixed release is 2.20.4.2, and the vuln.today decision label is act_now despite the independent assessment noting conflicting signals.
Electrum wallets before 4.8.3 can be tricked into replacing a just-broadcast Bitcoin transaction with a conflicting invalidly-signed transaction that pays an attacker, because the client does not verify signatures of wallet-owned inputs in unconfirmed mempool transactions. A malicious Electrum server can swallow the user's transaction and display a zero-fee forged copy; if the user then manually RBF fee-bumps and signs it, funds are lost. The vendor advisory reports that some servers are performing this attack and two user reports of losses exist; exploitation requires the user to manually bump the fee and sign the forged transaction, and the vuln.today decision label is act_now.
The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 lets unauthenticated remote attackers mark arbitrary WooCommerce orders as paid and completed, because incoming payment notifications are not checked for authenticity and, while the gateway remains unconfigured, are validated with a value derived from an empty secret that anyone can compute. Sites running WordPress with WooCommerce and this plugin active are exposed with no credentials required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3), and the impact is confined to order-state fraud rather than data exposure or outage. There is no CISA KEV entry and no confirmed exploitation; a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.11% (1st percentile).
Reflected cross-site scripting in Adobe Campaign Classic 7.4.4 build 9402 and earlier lets unauthenticated remote attackers inject script into a victim's browser session when an authenticated ACC user clicks a crafted URL, potentially enabling account or session takeover. The issue is rated CVSS 9.3 with scope change (S:C), high confidentiality and integrity impact, and mandatory user interaction (UI:R); because the payload is reflected rather than stored, each target must be lured individually. No public exploit code or exploitation has been identified at time of analysis, but the vendor-reported issue is prioritized as act_now given the high impact on authenticated sessions.
Crafted DICOM files uploaded to a reachable MONAILabel REST API can crash the inference pipeline or silently corrupt the geometry of returned segmentation masks, because MONAI Core's PydicomReader builds affine matrices from Decimal String (DS) tags without rejecting NaN or infinity. The affected package is the pip-distributed monai library before 1.6.1, which is used by MONAILabel (default REST API on port 8000, no authentication) as well as other MONAI consumers that route DICOM through PydicomReader; the assessed severity is CVSS 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L). The GitHub advisory includes proof-of-concept code and demonstrated HTTP 500 crashes against MONAI 1.5.2 with pydicom 3.0.2, but there is no CISA KEV listing or other confirmation of exploitation in the wild at time of analysis.
Electrum's built-in Nostr Wallet Connect plugin can be driven past the user's configured daily_limit_sat, letting an untrusted or compromised NWC client spend more of the wallet's Lightning balance than policy allows. All versions from 4.6.0 (where the plugin was introduced) through 4.7.1 are affected; 4.7.2 is the fixed release. Two trigger paths exist: concurrent pay_invoice requests that both clear budget_allows_spend() before add_to_budget() records the spend (CWE-367), and repeated sub-satoshi millisatoshi amounts that are floored to a smaller whole-satoshi figure during budget accounting. Exploitation requires an authenticated NWC connection issued by the user, the plugin enabled (it ships default-disabled) and a spending limit configured; no public exploit identified at time of analysis, and the vuln.today decision label is act_now.
Unauthenticated attackers can force the temporary-login secret in REDAXO core's bundled structure/history plugin (5.3.0 through 5.21.3) into a predictable state and then forge a login token that yields a backend session for any existing account, including an administrator. On installations that are not running in live mode, that backend access escalates to remote code execution via PHP introduced through templates, modules, actions or add-on installation; in live mode the bypass and backend compromise still occur but the RCE pivot does not apply. Exposure is limited to installations where the structure/history plugin is installed and activated, since it is not enabled by default, and no public exploit code was identified at time of analysis; the vendor fixed the flaw in 5.21.4.
Remote code execution in WatchGuard Fireware OS can be triggered by a crafted SIP request when the Firebox configuration includes a policy that uses the SIP proxy, causing a stack-based buffer overflow before authentication. EUVD lists Fireware OS 12.0 before 12.12.4, 2025.1 before 2026.4, and 12.0 before 12.5.22 as affected; the flaw is rated CVSS 9.2, and CVSS 4.0 AT:P reflects that a SIP-proxy policy must be present. No public exploit was identified at time of analysis.
Missing authentication in the Fireware OS FireCluster synchronization daemon lets remote, unauthenticated attackers invoke privileged system-level administrative actions on WatchGuard firewalls where clustering is enabled, by sending a specially crafted request to the FireCluster management IP. Only appliances actively running FireCluster are exposed, and exploitation additionally requires network reachability to that management IP; single-appliance deployments that do not run FireCluster are not affected. No public exploit code identified at time of analysis, but the vendor self-reported the flaw at CVSS 9.2 with confirmed fixes in every affected branch, and it is prioritized act_now.
Heap-based out-of-bounds write in WatchGuard Fireware OS Access Portal allows remote, unauthenticated attackers to corrupt memory by sending a crafted WebSocket request when the portal is enabled and reachable. The integer overflow (CWE-190) affects Fireware OS 12.0 before 12.5.22, 12.0 before 12.12.4, and 2025.1 before 2026.4, and exploitation also depends on an additional attack requirement that is not described in the available sources. No public exploit has been identified at time of analysis, and vendor patches are available.
Heap-based buffer overflow in the WatchGuard Fireware OS authentication service lets an attacker who controls or intercepts traffic to a Firebox's configured Active Directory server crash the authentication service and potentially execute arbitrary code. Exposure is limited to appliances configured to use AD-backed authentication and to attackers positioned to control or tamper with the Firebox-to-AD path (the AT:P attack requirement, which the independent assessment treats as the primary limiting factor); once that precondition is met, no Firebox credentials and no user interaction are required. WatchGuard has released fixed builds - Fireware OS 12.12.4, 12.5.22 and 2026.4 - and the issue carries an act_now priority, although no CISA KEV entry and no public exploit were identified at time of analysis.
Heap-based buffer overflow in the WatchGuard Fireware OS authentication service can let an attacker who controls or intercepts firewall-to-Active Directory traffic cause a denial of service and potentially execute arbitrary code. The flaw affects Fireware OS 12.0 before 12.5.22, 12.0 before 12.12.4, and 2025.1 before 2026.4; exploitation requires the Firebox to use AD authentication and the attacker to be positioned on the firewall-to-AD path (AT:P in the CVSS 4.0 vector). No public exploit was identified at time of analysis, and the vendor has released fixed versions.
Authenticated OS command injection in Sunhillo SureLine before 9.1.5 allows any holder of a web account to execute arbitrary commands as root on the appliance through the networkDiag.cgi diagnostic endpoint. The flaw affects SureLine 8.6.0 through versions before 9.1.5 and is triggered by URL-encoded newline (%0a) or ampersand (%26) separators in the ipAddr or dnsAddr parameters, bypassing the incomplete denylist from the CVE-2021-36380 fix. A vendor patch is available in 9.1.5, and no public exploit identified at time of analysis or CISA KEV entry was reported; the authentication prerequisite is the main barrier, though any web account suffices.
Arbitrary code execution in Adobe Campaign Classic (affected through version 7.4.4 build 9402) is possible through a SQL injection flaw that requires an authenticated attacker holding high administrative privileges. The issue is network-reachable, low-complexity, and requires no user interaction; successful exploitation changes scope and can compromise confidentiality, integrity, and availability. No public exploit was identified at time of analysis, and the independent assessment emphasizes that the high-privilege prerequisite is the primary factor limiting practical risk while the vendor advisory APSB26-162 remains the authoritative fix path.
Authorization bypass in the CDP Coordinator Service of Veeam Backup & Replication 13.x allows unauthenticated remote attackers to take actions the service should have refused, with high integrity and availability impact and a scope change into other components; confidentiality impact is not indicated. Installations running 13.0 before 13.0.3 or 13.1 before 13.1.2 are affected, and exposure depends on whether the CDP Coordinator Service is reachable from untrusted networks. Vendor fixes exist (13.0.3 and 13.1.2 per Veeam KB4948), the issue carries an act_now priority decision, and no public exploit code or confirmed active exploitation was identified in the available sources.
HCL Notes Client trusts TLS server certificates chained to eight eMudhra intermediate CAs whose private keys have been compromised, so an attacker positioned on the client's outbound network path can present forged certificates and man-in-the-middle TLS traffic. The flaw is remote and requires no credentials or user interaction (AV:N/PR:N/UI:N), but it is not exploitable from an arbitrary host: the attacker must first achieve an on-path position (AT:P) and the compromised intermediate must still be trusted in the client's chain. Successful abuse yields high confidentiality and integrity impact on the intercepted sessions; the source rates it CVSS 9.1 (4.0) with a vuln.today decision of act_now, and no public exploit code was identified at time of analysis.
HCL Domino Server's outbound TLS client trust accepts certificates chaining to eight eMudhra intermediate CAs whose private keys have been compromised, so an attacker holding a forged server certificate signed by one of those keys can impersonate outbound HTTPS/TLS destinations and intercept or modify Domino's outbound traffic. Affected builds are 2.0.2 FP8, 14.0 through 14.0 FP5, 14.5 and up to 14.5.1 FP1; the CVSS 4.0 base score is 9.1, and the independently assessed 3.1 vector is AV:N/AC:H/PR:N/UI:N with high confidentiality and integrity impact and no availability impact, reflecting that a man-in-the-middle position on the outbound connection path is a prerequisite. No public exploit code was identified at time of analysis, but HCL has issued a vendor fix and the vuln.today decision label is act_now, making this a near-term patching priority.
PHP code injection in GRR (JeromeDevome reservation/resource-management application) prior to 4.5.0 lets an authenticated administrator turn LDAP connector settings into arbitrary PHP executed by the web server. The admin must first register an LDAP connector and complete a successful bind - trivially arranged by pointing GRR at an attacker-controlled LDAP server - then submit malicious values in fields such as ldap_filter, which are persisted into /personnalisation/config_ldap.inc.php. Because the injected payload lands in an included PHP configuration file, successful exploitation yields code execution with the web server's privileges (CVSS 9.1, scope-changed); the vendor has released GRR 4.5.0 with input validation, and no public exploit is identified at time of analysis, though the advisory severity warrants priority patching.
SQL injection in Adobe Campaign Classic, affecting versions up to and including 7.4.4 build 9402, allows an authenticated low-privileged attacker to bypass security controls and obtain unauthorized read access plus limited write capability over the network without user interaction. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and the vuln.today priority label is act_now. No public exploit code or proof-of-concept was identified in the available sources at time of analysis.
TLS certificate verification is disabled by default in Eclipse ioFog Operator 3.8.0 through 3.9.1 on the connections it makes to the Controller API and to an external OIDC issuer, so an unauthenticated on-path attacker can present any certificate and be trusted. That position lets the attacker capture the OAuth client secret in external mode, or the Controller bootstrap admin password in embedded mode with Controller HTTPS enabled, and supply the access token the operator stores for later Controller API calls. Exploitation is gated by the requirement to already sit in the traffic path (CVSS 4.0 AT:P), which is the main limiting factor; vendor priority is act_now, and no public exploit has been identified at time of analysis.
A path-scoped middleware bypass in @fastify/express 4.0.5 through 4.0.8 lets an unauthenticated remote attacker reach handlers protected by Express middleware such as authentication, authorization, or rate limiting. The flaw only manifests when Fastify is started with the non-default routerOptions.ignoreDuplicateSlashes: true and a request is sent with an absolute-form target (e.g. GET http://host/admin/dashboard), which the Fastify router normalizes and dispatches to the scoped handler while the Express layer no longer sees the scoped path. Exploitation is gated by that specific configuration plus reliance on path-scoped Express middleware; no public exploit code or CISA KEV entry was identified in the supplied data, though the vendor rates it CVSS 9.1 and priority guidance is act_now. Fixed in 4.0.9.
SQL injection in Veeam M365 Backup 8.0 through 8.5.0.1014 lets an authenticated organization-transfer peer inject into the configuration database, enabling cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account. The issue is rated act_now, but exploitation requires a legitimate organization-transfer peer relationship and use of organization-transfer functionality, which limits exposure to configured multi-tenant/transfer scenarios rather than default standalone installations. No public exploit identified at time of analysis.
Unauthenticated remote file read in Sunhillo SureLine before 9.1.5 exposes sensitive system files, including /etc/shadow, the web user database, the root SSH private key, and the device TLS private key. The radarUpdater.cgi endpoint lacks authentication checks and does not sufficiently sanitize the filename parameter, allowing directory traversal sequences to read arbitrary files with root privileges. SureLine versions 8.0.0 up to but not including 9.1.5 are affected; a vendor patch is available, and no public exploit was identified at time of analysis.
An out-of-bounds write in the screen-image decoder of TeamViewer Full Client for Linux and macOS allows a remote attacker to execute arbitrary code on the victim's machine when the victim takes a user-driven action. Every build below 15.83 is affected, including the older branches prior to 13.2.154007 (macOS) / 13.2.154008 (Linux) and prior to 14.7.48868; the two described paths are opening a crafted .tvs session recording supplied by the attacker or participating in a remote-control session into which crafted screen-image data is injected, which is why the assessed vector carries UI:R with PR:N at CVSS 8.8. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the issue is prioritized for remediation this week given the code-execution impact on unpatched endpoints.
Privilege escalation in Cronicle through 0.9.120 lets an authenticated non-administrator user, or a scoped API key, that holds only create_events and run_events privileges inject top-level uid and gid fields into an event, which the root daemon then honours when launching the child process - so the low-privileged principal can run jobs as any local account, including root. Root compromise depends on the deployment mode: the advisory states a root-running daemon is the default per docs/Setup.md, while on a non-root daemon the impact is bounded by the daemon's own privileges; the injected identity also only survives with plugins that do not define their own uid, which is true of the shipped shellplug and urlplug defaults. This is a distinct sibling of the previously patched job-output injection tracked as CVE-2026-39401. Vendor-released patch: 0.9.121; no CISA KEV listing and no confirmed weaponized exploit, though the advisory publishes a working reproduction script; the assessed priority is to remediate this week.
Command injection in Ubiquiti airMAX M devices running firmware below 6.3.26 is reachable through a cross-site request forgery weakness in the device's web management interface, letting an attacker who lures a logged-in administrator to a malicious page run commands on the device with high confidentiality and integrity impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms the attacker needs no credentials of their own, but exploitation depends on a victim holding an active authenticated management session while loading the attacker-controlled page. No CISA KEV listing and no public exploit were identified at time of analysis, and EPSS is low at 0.38% (32nd percentile), making this a genuine priority for this week rather than a drop-everything emergency.
Command injection in the Autodesk Fusion Post Processor Utility extension (5.0.1 up to, but not including, 5.0.2) allows a remote attacker to execute arbitrary commands in the context of the current user when a victim opens a maliciously crafted .stack.json file. The attacker needs no credentials and the complexity is low, but exploitation is gated by user interaction: the hostile file must be delivered to and loaded by the target, so there is no zero-click remote path. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; impact is bounded by the privileges of the user who opens the file.
Privilege escalation in the Kirki plugin for WordPress (all versions up to and including 6.2.5) allows authenticated users with only Subscriber-level access to reach a vulnerable deserialization path in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher, which lacks a capability check, and to inject a PHP object. Because a POP chain is present in the running code, a successful injection can overwrite an administrator's password and hand the attacker full administrative control of the site. The CVSS vector confirms network reachability, low privileges (PR:L), and no user interaction (UI:N) for a high-integrity, high-availability impact; EPSS is low at 0.30% (23rd percentile) and there is no KEV listing, so there is no public exploit identified at time of analysis, though the practical exposure is governed by whether a site permits open user registration.
Integer overflow in TeamViewer's remote-control screen processing component affects Full Client, Portable, and Remote Control App versions before 15.83, allowing a malicious or already compromised remote host to crash the viewer and, on some platforms, potentially execute code with the viewer process's privileges. The victim must deliberately establish an outbound remote-control session as the viewer (UI:R), so the attack model is targeted or social-engineering oriented rather than unsolicited remote compromise. No public exploit code has been identified at time of analysis, and vendor patches are available.
Memory corruption in the V8 JavaScript engine of Google Chrome before 156.0.8078.73 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. User interaction is mandatory and the resulting code execution is sandbox-contained, so compromising the host would require an additional sandbox-escape flaw; the CVSS 3.1 score is 8.8 with C:H/I:H/A:H. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.73; the priority is this week, not an emergency.