Crafted DICOM files uploaded to a reachable MONAILabel REST API can crash the inference pipeline or silently corrupt the geometry of returned segmentation masks, because MONAI Core's PydicomReader builds affine matrices from Decimal String (DS) tags without rejecting NaN or infinity. The affected package is the pip-distributed monai library before 1.6.1, which is used by MONAILabel (default REST API on port 8000, no authentication) as well as other MONAI consumers that route DICOM through PydicomReader; the assessed severity is CVSS 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L). The GitHub advisory includes proof-of-concept code and demonstrated HTTP 500 crashes against MONAI 1.5.2 with pydicom 3.0.2, but there is no CISA KEV listing or other confirmation of exploitation in the wild at time of analysis.
Electrum's built-in Nostr Wallet Connect plugin can be driven past the user's configured daily_limit_sat, letting an untrusted or compromised NWC client spend more of the wallet's Lightning balance than policy allows. All versions from 4.6.0 (where the plugin was introduced) through 4.7.1 are affected; 4.7.2 is the fixed release. Two trigger paths exist: concurrent pay_invoice requests that both clear budget_allows_spend() before add_to_budget() records the spend (CWE-367), and repeated sub-satoshi millisatoshi amounts that are floored to a smaller whole-satoshi figure during budget accounting. Exploitation requires an authenticated NWC connection issued by the user, the plugin enabled (it ships default-disabled) and a spending limit configured; no public exploit identified at time of analysis, and the vuln.today decision label is act_now.
Unauthenticated attackers can force the temporary-login secret in REDAXO core's bundled structure/history plugin (5.3.0 through 5.21.3) into a predictable state and then forge a login token that yields a backend session for any existing account, including an administrator. On installations that are not running in live mode, that backend access escalates to remote code execution via PHP introduced through templates, modules, actions or add-on installation; in live mode the bypass and backend compromise still occur but the RCE pivot does not apply. Exposure is limited to installations where the structure/history plugin is installed and activated, since it is not enabled by default, and no public exploit code was identified at time of analysis; the vendor fixed the flaw in 5.21.4.
Remote code execution in WatchGuard Fireware OS can be triggered by a crafted SIP request when the Firebox configuration includes a policy that uses the SIP proxy, causing a stack-based buffer overflow before authentication. EUVD lists Fireware OS 12.0 before 12.12.4, 2025.1 before 2026.4, and 12.0 before 12.5.22 as affected; the flaw is rated CVSS 9.2, and CVSS 4.0 AT:P reflects that a SIP-proxy policy must be present. No public exploit was identified at time of analysis.
Missing authentication in the Fireware OS FireCluster synchronization daemon lets remote, unauthenticated attackers invoke privileged system-level administrative actions on WatchGuard firewalls where clustering is enabled, by sending a specially crafted request to the FireCluster management IP. Only appliances actively running FireCluster are exposed, and exploitation additionally requires network reachability to that management IP; single-appliance deployments that do not run FireCluster are not affected. No public exploit code identified at time of analysis, but the vendor self-reported the flaw at CVSS 9.2 with confirmed fixes in every affected branch, and it is prioritized act_now.
Heap-based out-of-bounds write in WatchGuard Fireware OS Access Portal allows remote, unauthenticated attackers to corrupt memory by sending a crafted WebSocket request when the portal is enabled and reachable. The integer overflow (CWE-190) affects Fireware OS 12.0 before 12.5.22, 12.0 before 12.12.4, and 2025.1 before 2026.4, and exploitation also depends on an additional attack requirement that is not described in the available sources. No public exploit has been identified at time of analysis, and vendor patches are available.
Heap-based buffer overflow in the WatchGuard Fireware OS authentication service lets an attacker who controls or intercepts traffic to a Firebox's configured Active Directory server crash the authentication service and potentially execute arbitrary code. Exposure is limited to appliances configured to use AD-backed authentication and to attackers positioned to control or tamper with the Firebox-to-AD path (the AT:P attack requirement, which the independent assessment treats as the primary limiting factor); once that precondition is met, no Firebox credentials and no user interaction are required. WatchGuard has released fixed builds - Fireware OS 12.12.4, 12.5.22 and 2026.4 - and the issue carries an act_now priority, although no CISA KEV entry and no public exploit were identified at time of analysis.
Heap-based buffer overflow in the WatchGuard Fireware OS authentication service can let an attacker who controls or intercepts firewall-to-Active Directory traffic cause a denial of service and potentially execute arbitrary code. The flaw affects Fireware OS 12.0 before 12.5.22, 12.0 before 12.12.4, and 2025.1 before 2026.4; exploitation requires the Firebox to use AD authentication and the attacker to be positioned on the firewall-to-AD path (AT:P in the CVSS 4.0 vector). No public exploit was identified at time of analysis, and the vendor has released fixed versions.
Arbitrary code execution in Adobe Campaign Classic (affected through version 7.4.4 build 9402) is possible through a SQL injection flaw that requires an authenticated attacker holding high administrative privileges. The issue is network-reachable, low-complexity, and requires no user interaction; successful exploitation changes scope and can compromise confidentiality, integrity, and availability. No public exploit was identified at time of analysis, and the independent assessment emphasizes that the high-privilege prerequisite is the primary factor limiting practical risk while the vendor advisory APSB26-162 remains the authoritative fix path.
Authorization bypass in the CDP Coordinator Service of Veeam Backup & Replication 13.x allows unauthenticated remote attackers to take actions the service should have refused, with high integrity and availability impact and a scope change into other components; confidentiality impact is not indicated. Installations running 13.0 before 13.0.3 or 13.1 before 13.1.2 are affected, and exposure depends on whether the CDP Coordinator Service is reachable from untrusted networks. Vendor fixes exist (13.0.3 and 13.1.2 per Veeam KB4948), the issue carries an act_now priority decision, and no public exploit code or confirmed active exploitation was identified in the available sources.
HCL Notes Client trusts TLS server certificates chained to eight eMudhra intermediate CAs whose private keys have been compromised, so an attacker positioned on the client's outbound network path can present forged certificates and man-in-the-middle TLS traffic. The flaw is remote and requires no credentials or user interaction (AV:N/PR:N/UI:N), but it is not exploitable from an arbitrary host: the attacker must first achieve an on-path position (AT:P) and the compromised intermediate must still be trusted in the client's chain. Successful abuse yields high confidentiality and integrity impact on the intercepted sessions; the source rates it CVSS 9.1 (4.0) with a vuln.today decision of act_now, and no public exploit code was identified at time of analysis.
HCL Domino Server's outbound TLS client trust accepts certificates chaining to eight eMudhra intermediate CAs whose private keys have been compromised, so an attacker holding a forged server certificate signed by one of those keys can impersonate outbound HTTPS/TLS destinations and intercept or modify Domino's outbound traffic. Affected builds are 2.0.2 FP8, 14.0 through 14.0 FP5, 14.5 and up to 14.5.1 FP1; the CVSS 4.0 base score is 9.1, and the independently assessed 3.1 vector is AV:N/AC:H/PR:N/UI:N with high confidentiality and integrity impact and no availability impact, reflecting that a man-in-the-middle position on the outbound connection path is a prerequisite. No public exploit code was identified at time of analysis, but HCL has issued a vendor fix and the vuln.today decision label is act_now, making this a near-term patching priority.
PHP code injection in GRR (JeromeDevome reservation/resource-management application) prior to 4.5.0 lets an authenticated administrator turn LDAP connector settings into arbitrary PHP executed by the web server. The admin must first register an LDAP connector and complete a successful bind - trivially arranged by pointing GRR at an attacker-controlled LDAP server - then submit malicious values in fields such as ldap_filter, which are persisted into /personnalisation/config_ldap.inc.php. Because the injected payload lands in an included PHP configuration file, successful exploitation yields code execution with the web server's privileges (CVSS 9.1, scope-changed); the vendor has released GRR 4.5.0 with input validation, and no public exploit is identified at time of analysis, though the advisory severity warrants priority patching.
SQL injection in Adobe Campaign Classic, affecting versions up to and including 7.4.4 build 9402, allows an authenticated low-privileged attacker to bypass security controls and obtain unauthorized read access plus limited write capability over the network without user interaction. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and the vuln.today priority label is act_now. No public exploit code or proof-of-concept was identified in the available sources at time of analysis.
TLS certificate verification is disabled by default in Eclipse ioFog Operator 3.8.0 through 3.9.1 on the connections it makes to the Controller API and to an external OIDC issuer, so an unauthenticated on-path attacker can present any certificate and be trusted. That position lets the attacker capture the OAuth client secret in external mode, or the Controller bootstrap admin password in embedded mode with Controller HTTPS enabled, and supply the access token the operator stores for later Controller API calls. Exploitation is gated by the requirement to already sit in the traffic path (CVSS 4.0 AT:P), which is the main limiting factor; vendor priority is act_now, and no public exploit has been identified at time of analysis.
A path-scoped middleware bypass in @fastify/express 4.0.5 through 4.0.8 lets an unauthenticated remote attacker reach handlers protected by Express middleware such as authentication, authorization, or rate limiting. The flaw only manifests when Fastify is started with the non-default routerOptions.ignoreDuplicateSlashes: true and a request is sent with an absolute-form target (e.g. GET http://host/admin/dashboard), which the Fastify router normalizes and dispatches to the scoped handler while the Express layer no longer sees the scoped path. Exploitation is gated by that specific configuration plus reliance on path-scoped Express middleware; no public exploit code or CISA KEV entry was identified in the supplied data, though the vendor rates it CVSS 9.1 and priority guidance is act_now. Fixed in 4.0.9.
SQL injection in Veeam M365 Backup 8.0 through 8.5.0.1014 lets an authenticated organization-transfer peer inject into the configuration database, enabling cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account. The issue is rated act_now, but exploitation requires a legitimate organization-transfer peer relationship and use of organization-transfer functionality, which limits exposure to configured multi-tenant/transfer scenarios rather than default standalone installations. No public exploit identified at time of analysis.