Unauthenticated visitors to Grav 1.7.53.3 through 1.7.53.5 can read stored Clockwork profiler records when the debugger is enabled with the Clockwork provider and Grav sits behind a same-host reverse proxy; those records can include submitted administrator login passwords unless debugger.censored is enabled, plus configuration credentials from system and plugin settings. The flaw is an authorization bypass in Debugger::isDebuggerRequestAuthorized() that trusts a loopback REMOTE_ADDR fallback, so a tokenless request arriving from the local proxy is accepted; direct-server deployments and sites with the debugger disabled are not exposed. It carries CVSS 4.0 8.7 and a this_week priority, making it a credible high-impact information-disclosure case whose real-world risk is strongly gated by deployment topology; no public exploit was identified at time of analysis.
Unauthenticated arbitrary file read in Hitachi Energy TRO600 Series firmware 9.0.0.0 through 9.1.1.0 lets remote attackers with network reachability to the device's management interface disclose sensitive files, including configuration and password data. The flaw is a missing-authentication condition (CWE-306) with confidentiality-only impact, and the available intelligence does not confirm active exploitation; no public exploit identified at time of analysis. Risk is real within the product's deployment niche but bounded by footprint and exposure.
svg-sanitizer 0.5.3 through 1.0.0 can be driven into quadratic CPU consumption when Sanitizer::sanitize() strips PHP tags from attacker-supplied SVG content, letting an unauthenticated user who can submit an SVG occupy a PHP worker for seconds to minutes in the default configuration. The pre-parse loop removes overlapping PHP tags one pass at a time while rescanning the entire input, and because it executes before XML parsing the allowHugeFiles setting does not mitigate it. The vendor fixed this in 1.1.0, and the GHSA advisory includes a proof-of-concept input generator; the supplied data contains no CISA KEV entry.
Unauthenticated stored cross-site scripting in the DJ-HelpfulArticles voting module for Joomla (affected versions 1.0.0 through 1.2.0) lets remote attackers plant persistent script in the site database through the client-supplied 'ip' field of the getDeny, getConfirm and getDenyReason com_ajax handlers, which store the submitted value verbatim rather than deriving it from the connection. The injected payload is later rendered without output escaping in the administrator backend 'Helpful articles' overview (views/items/tmpl/default.php), so it executes only when a logged-in administrator opens that page - a passive user-interaction prerequisite reflected in the assessed vector (UI:R, scope changed C:H/I:H). No public exploit code has been identified at time of analysis, and the vendor has released version 1.3.0 as the fixed release.
Service account impersonation in Octopus Server stems from inconsistent OIDC token issuer validation, allowing a token minted by a non-legitimate issuer to be accepted as if it came from a legitimate trusted issuer. Deployments are exposed only when OIDC is in use for at least one service account identity, and a attacker must additionally know or guess details of that specific identity and operate a rogue issuer that can mint a matching token - conditions that favour targeted attacks over opportunistic scanning. Vendor CVSS 4.0 score is 8.7; the assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H) likewise reflects high complexity and high confidentiality, integrity and availability impact, and no public exploit has been identified at time of analysis.
Semantic MediaWiki before 7.3.1 exposes Special:PropertyLabelSimilarity without an administrator restriction, and a caller-supplied limit of zero or a negative value bypasses the SQL LIMIT, loading the property pool into an O(n^2) pairwise label comparison. Unauthenticated remote attackers can send repeated requests to consume PHP CPU and memory and hold database connections; the impact is availability-only and grows with the number of user-defined properties, so it is most disruptive on large wikis. Active exploitation is not reported (SSVC exploitation: none), and a public proof-of-concept request is documented in the advisory but is not verified as working exploit code.
Semantic MediaWiki 2.5.0 through 7.3.0 lets an editor with ordinary page-edit permission exhaust server CPU, memory and the semantic store by calling the #set_recurring_event parser function with a large caller-controlled limit parameter and no end date, causing the parser to build thousands or millions of date subobjects in a single parse because the smwgMaxNumRecurringEvents ceiling is only enforced in the end-date branch. Exploitation requires the ability to save or render a page that will be parsed - an authenticated editor under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), rising to unauthenticated if the wiki has anonymous editing enabled (PR:N, 7.5); the CVE record carries a CVSS v4.0 score of 8.7 with PR:N, which reflects that anonymous-editing configuration. There is no CISA KEV entry and no confirmed active exploitation; the upstream advisory includes a bounded proof-of-concept that was run only against an isolated fixture, and impact is availability only with no data disclosure or modification.
Quadratic CPU consumption in Semantic MediaWiki's term parser gives unauthenticated visitors a way to tie up PHP search workers on wikis that run the SMW extended search backend. Versions 3.0.0 through 7.3.0 are affected: a search term packed with thousands of distinct in:(...) / has:(...) expressions makes TermParser::normalize_compact_form() rescan and copy the entire input once per match, and the vendor's own parser-only timings show roughly a 4x cost for each doubling of expression count (about 880 ms for an 8,000-expression, ~104 KB term). Signals point to a genuine but bounded availability risk - the extended search engine is a non-default, explicitly enabled backend, request-size or time limits may blunt the attack, and no worker crash or service-wide outage was demonstrated; a public PoC reference exists (a self-contained PHP script that calls the parser directly), it is not verified as working exploit code against a full wiki, and there is no KEV listing or other confirmation of active exploitation.
Unauthenticated CPU and memory exhaustion in Semantic MediaWiki 3.0.0 up to (but not including) 7.3.1 allows remote attackers to POST a deeply nested <q>...</q> query to the public action=ask / Special:Ask API, tying up PHP request workers. LegacyParser::getSubqueryDescription() recurses once per opening <q> token before the configured smwgQMaxDepth and query-size pruning in the Query layer ever run, so a payload of roughly 120 KB can burn seconds of CPU and tens of MiB of memory per request. Exploitation requires the ask API to be publicly reachable and the deployment to accept a ~120 KB POST body; authentication requirements are unconfirmed for restricted wikis but the assessed vector is PR:N (unauthenticated) for public wikis, a public PoC reference exists and is not verified as working exploit code against a live MediaWiki instance, and the demonstrated outcome is worker consumption and capacity degradation rather than a confirmed service-wide outage.
A stack-based buffer overflow in the certd certificate management process of WatchGuard Fireware OS allows an attacker who already holds high-privileged, authenticated access to the Firebox management interface (CVSS PR:H) and can reach certd over the network to send a crafted request that overflows a stack buffer, crashing the certificate management service and, per the vendor, potentially achieving arbitrary code execution. The confirmed effect is a denial of service against certd; reliable code execution is described only as a potential outcome, and the exact request structure that triggers the overflow is not described in the available sources. Fixed releases are 12.12.4, 12.5.22 and 2026.4; no public exploit has been identified at time of analysis and the issue is not in CISA KEV.
OS command injection in the ATXP Gemini CLI extension through 1.0.0 lets an attacker who controls email or SMS fields such as message_id, subject, or query execute shell commands through MCP tool calls, running at the victim user's privilege level. The victim must be running the extension and route the crafted message through its tools; the supplied CVSS 4.0 score is 8.5 (High), and no public exploit is identified at time of analysis, with no KEV status provided in the supplied data. No fixed version is stated in the available intelligence.
Local code execution in Electrum 4.6.0 through 4.7.1 stems from an authorization bypass in the external plugin loader: a rogue process on the same machine that can write to the Electrum data directory can place plugin code in plugins/ and mark it enabled in the config file, after which Electrum loads the plugin's __init__.py without verifying the plugin-password signature and runs attacker code inside the main Python process. The issue is rated CVSS 4.0 8.6 (High) and assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, although exploitation requires prior local write access at the victim's user level. Electrum 4.7.2 contains the vendor fix, and no public exploit identified at time of analysis.
Cross-site request forgery in REDAXO's backend user administration (page=users/users) lets an attacker who merely gets a logged-in backend user to open a crafted link modify arbitrary user records - granting administrator rights, deactivating accounts, or locking out the only administrator. The vendor's advisory explains that the CSRF token check sat behind a `save` condition that the `FUNC_UPDATE`/`FUNC_APPLY` write path did not share, so a single GET request with `FUNC_UPDATE=1` and no token reached the update logic; because parameters are read through `rex_request()` against `$_REQUEST`, and the session cookie defaults to `SameSite=Lax` (still sent on top-level GET navigation), no form or JavaScript is needed. The attacker needs no account or privilege of their own, but a victim must have an active REDAXO backend session and the `users[]` permission, and the privilege-escalation variant specifically needs that victim to be an administrator; passwords cannot be set through this path because `userpsw` is read via `rex_post()`. No public exploit code or confirmed active exploitation was identified in the supplied sources; the vendor-released fix is 5.21.3 and the priority decision is to act this week.
Privilege escalation in Octopus Server lets an authenticated user who already holds the System Manager role obtain full system Administrator rights, with risk concentrated in environments that grant that role to users not otherwise trusted as full administrators or where such an account is compromised. The affected ranges are 2019.0.0 through <2026.2.13469 and 2026.3.0 through <2026.3.15863, and the CVSS vector's PR:H metric confirms the required high-privileged account, so this is not a remote-unauthenticated attack. No public exploit is identified at time of analysis, the vendor has released a patch, and the supplied priority label is this_week.
Veeam ONE 13.1 (through build 13.1.0.7233) exposes a global multi-factor authentication toggle that can be used before the operator's own second-factor check completes, so an attacker who already holds valid Administrator credentials can switch MFA off for the whole deployment and then authenticate with the password alone. The CVSS 4.0 score of 8.5 with PR:H reflects that this is not an initial-access path: it converts a stolen or guessed administrator password into full administrative control by removing the second factor, with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation are identified in the available data, and the priority label places remediation in the current week rather than as an emergency.
Heap out-of-bounds write in llama.cpp builds b5899 through b10260 lets an attacker corrupt heap memory when the victim loads a crafted GGUF model that uses the PLaMo2 tokenizer. A BYTE-typed token whose text parses to a negative value (for example <0x-1>) is used as an index into the tokenizer's bytes_ buffer during model loading, so the write lands before the buffer and can crash the process or potentially enable code execution. The flaw is local in nature (it triggers only when an untrusted model is loaded, per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R vector), a vendor patch is available in build b10261, no public exploit has been identified at time of analysis, and EPSS is low at 0.14% (3rd percentile) with a this_week priority label.
Improper authentication in OAuthLib's RFC 8628 device authorization grant allows a remote caller to obtain a bearer token without ever presenting a valid device_code. The token endpoint accepts any value (or none) in the device_code parameter because DeviceCodeGrant.validate_token_request performs no validation of it, so anyone who knows a client_id registered for the device_code grant can mint a token for that client. Affected are Python projects using oauthlib 3.3.0 through pre-4.0.0 that expose the device workflow at their token endpoint; the vendor-released fix is 4.0.0. No public exploit tooling or active exploitation is confirmed, and the advisory's reproduction scenario additionally depends on the integrator's RequestValidator.authenticate_client accepting public clients, a behavior tied to separate oauthlib issue #919.
OS command injection in the hagent MCP server (masc-ucsc/hagent, through commit 761eec6) lets an MCP client that can reach the hagent_arduino or hagent_esp32 tools run arbitrary shell commands as the MCP server user by placing shell metacharacters in the args parameter, which is interpolated into arduino-cli and idf.py command lines executed with subprocess.run(shell=True). The attacker must already hold the low-privileged position of an MCP client (or drive one through prompt injection), so this is local-vector code execution bounded by the server's account rather than a pre-authentication remote takeover, but any deployment that exposes these embedded-build tools to an untrusted or LLM-driven caller is fully compromised on confidentiality, integrity and availability. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; the EUVD/VulnCheck disclosure and an upstream GitHub issue are the only public signals, and the vulnerability is tracked for patching this week.
OS command injection in Kali-GPT's MCP server (execute_tool() in kali_gpt/tools/mcp_server.py) allows any party able to act as an MCP client - including an AI agent that has been prompt-injected - to run arbitrary shell commands as the MCP server's user by embedding shell metacharacters in scanner parameters such as target, ports, domain, wordlist, or url. All code through commit a608c74e99910232dd208fee99de860458672b82 is affected; the vendor has published no fixed version, and a GitHub issue (#12) is the only upstream tracking reference. CVSS 4.0 scores it 8.5 (assessed CVSS 3.1: AV:L/AC:L/PR:L/UI:N, C/I/A High), reflecting full confidentiality, integrity and availability impact but requiring the attacker to already reach or drive the MCP server rather than attack it anonymously from the internet; no public exploit code and no CISA KEV entry were identified at time of analysis, and the vulnerability is prioritized as a this-week item.
OS command injection in the esp-mcp MCP server (all versions through commit 28afddf9ff41ada117bb45fd49b526d3bf89749e) lets an attacker who can influence LLM agent tool calls - typically through prompt injection - place shell metacharacters into the target, port, project_path or project_name parameters, which are handed to asyncio.create_subprocess_shell at main.py line 80; the injected commands then execute as the user running the MCP server. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.5), so exploitation presupposes low-privileged access to the tool interface plus an agent deployment that actually exposes these tools and accepts attacker-influenced input, rather than a network-reachable default path; no public exploit has been identified at time of analysis and no fixed version is identified in the supplied data. Overall risk signals are mixed, indicating a real but non-urgent and narrowly-scoped issue that should be scheduled for this week rather than treated as an emergency.
OS command injection in Codefriar sf-mcp through 1.3.2 allows an actor who can supply or influence Salesforce CLI tool flag values to run arbitrary shell commands as the MCP server user. The root cause is escapeValue() in src/utils.ts, which leaves backticks, $() substitution and other shell metacharacters intact, so crafted flag values reach execSync inside executeSfCommand. Both the CVSS 4.0 vector and the independent assessment treat the attack vector as local with low privileges and no user interaction, with high confidentiality, integrity and availability impact to the host running the server; no public exploit code is confirmed in the available sources, and the issue is prioritised for remediation this week.
Command injection in DroidMind through 0.4.0 lets a connected MCP client - including an AI agent subverted through prompt injection - slip past the shell-command allowlist and run blocked operations such as reboot on an attached Android device. The weakness sits in parameters interpolated into Device.run_shell() and in the unvalidated Device.list_directory(), where $(...) and backtick substitution are evaluated by the shell rather than by the allowlist check. The assessed vector is AV:L/PR:L, so an attacker must already be able to supply parameters to the DroidMind MCP interface and an ADB-connected device must be present; no public exploit was identified at time of analysis.
OS command injection in the ai-sdlc plugin MCP server (versions through 0.31.2) allows an attacker who can control the 'repo' argument of the check-issue or check-pr-status tools to run arbitrary shell commands with the privileges of the MCP server user. The unvalidated repo value is interpolated into 'gh issue view' / 'gh pr view' strings executed through execSync(), so a prompt-injected AI agent invoking the tool can turn a crafted repository name into command execution on the host. The vendor has published a fix (commit 717d7ec) and the issue is tracked as EUVD-2026-110836; no public exploit code was identified at time of analysis, and priority guidance places remediation in the current week (this_week).
SQL injection (CWE-89) in NVIDIA NeMo Agent Toolkit versions 1.4 through 1.6 lets an attacker who can reach the toolkit's input path on the local system inject arbitrary SQL, with potential for data tampering, denial of service, and information disclosure. NVIDIA rates the flaw 8.4 (High) and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - unauthenticated with no user interaction, but local, so exploitation requires local reachability of the vulnerable query path rather than network access; that AV:L designation is atypical for SQL injection and is the main factor shaping real-world risk. No public exploit code was identified at time of analysis and the issue does not appear in CISA KEV; per the current decision signal this is a this-week priority rather than an emergency.
TensorRT-LLM 1.3.0rc24 can load a tokenizer from an attacker-influenced location during KvCacheAwareRouter initialization, allowing inclusion of functionality from an untrusted control sphere (CWE-829). Because the CVSS vector is AV:L with PR:N and UI:N, the untrusted tokenizer must be reachable inside the local loading path, but once it is, no credentials or user interaction are needed; successful exploitation can yield code execution, information disclosure, data tampering, and denial of service. NVIDIA reports the issue with a base score of 8.4, and no public exploit code or confirmed active exploitation was identified at time of analysis. Only deployments that actually use the KvCacheAwareRouter and load tokenizers from unverified sources sit in the exploitable path.
Cross-site scripting in Sisense Cloud BI Platform lets an authenticated low-privilege user submit a base64-encoded SVG data URI (data:image/svg+xml;base64) to the /api/v2/ai/sessions API, and script tags embedded in that SVG execute when the image is rendered in the AI assistant window, allowing JavaScript to run in the viewer's context and the displayed content to be altered. Successful exploitation requires the attacker to hold a valid account that can reach the sessions endpoint, and execution only occurs when a victim opens the assistant window (UI:A, PR:L per both the CVSS 4.0 vector and the independent assessment), which confines realistic abuse to account-holders or multi-tenant insiders rather than anonymous remote attackers. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; EPSS is 0.39% (33rd percentile) and the vuln.today decision label is this_week, consistent with an assessment of a genuine but second-tier priority rather than an emergency.
Stored cross-site scripting in Sisense Cloud BI Platform's BloX widgets allows an authenticated user with widget authoring privileges to place HTML and JavaScript in the 'desc' and 'text' fields via /api/dashboards/<id>/widgets/<id>; the script runs when another user renders the widget, potentially exposing data available to that victim's session. The vendor-assigned CVSS 4.0 base score is 8.3, and exploitation requires a valid low-privilege account plus victim interaction. No public exploit was identified at time of analysis; EPSS is 0.39% (33rd percentile).
A missing authorization check in the Google Compute Engine disks.createSnapshot and regionDisks.createSnapshot APIs let an authenticated Cloud principal request a snapshot of a disk belonging to a different project, exposing cross-project disk data. Google remediated the flaw server-side on 31 August 2026 and states no customer action is needed, so current deployments are not exploitable; the exposure window is historical, covering Compute Engine use before that date. Confidentiality impact is high (disk contents could be read) but integrity and availability are unaffected, and no public exploit code or active exploitation has been identified at time of analysis, with an EPSS score of 0.35% (29th percentile).
Veeam Backup for Microsoft 365 8.0 through 8.5.0.1014 lets an account that already holds the product's Administrator role read arbitrary files on the backup server at LocalSystem privilege level, exposing host files and backup data to a high-privileged insider or to anyone who compromises an admin account. The underlying problem is a missing or incorrect authorization check (CWE-863) reachable over the network with low complexity and no user interaction, but it is gated on Administrator-level console access rather than being anonymously exploitable. No public exploit code has been identified at time of analysis.
A stack buffer overflow in Asterisk's res_pjsip_pubsub module allows a remote sender to corrupt a fixed-size buffer while parsing the Message-Account field of an inbound MWI NOTIFY message-summary body, which can corrupt the underlying SIP transport and permanently disable all SIP functionality until the daemon is restarted. Per the CVSS 4.0 vector (8.2) and the assessed CVSS 3.1 vector the attacker needs no authentication (PR:N) and no user interaction (UI:N), but attack complexity is high (AC:H); the impact is availability only (VC:N/VI:N/VA:H), with no confidentiality or integrity loss and no code execution asserted. All Asterisk branches prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11 / 22.8-cert3 are affected; no public exploit was identified at time of analysis.
Asterisk's REST Interface (ARI) allows a caller holding only read-only credentials to invoke write-capable dialplan functions - most notably FILE() - through the setChannelVar operation, even when live_dangerously is set to no in asterisk.conf, so a supposedly low-privilege ARI user can write files on the PBX host. Affected releases are Asterisk 20.x through 20.20.0, 21.x through 21.12.2, 22.x through 22.10.0, 23.x through 23.4.0, plus Certified Asterisk 20.7-cert10 and 22.8-cert2 and earlier; exposure requires the Asterisk HTTP server to be enabled and reachable and the attacker to already hold valid read-only ARI credentials. No public exploit code was identified at time of analysis, and vendor patches are available in 20.20.1, 21.12.3, 22.10.1, 23.4.1, Certified 20.7-cert11 and Certified 22.8-cert3.
Reflected cross-site scripting in the installation/upgrade script (installation/maj.php) of GRR, the PHP resource-management and reservation application, allows an attacker to run arbitrary JavaScript in a logged-in user's browser by getting that user to open a crafted URL containing a payload in the forcemaj parameter. The decisive precondition is that the installation directory was never deleted after setup - the advisory notes this cleanup is manual and not automatic - so instances where installation/maj.php remains web-accessible are the ones at risk; because the GRR authentication cookie is not marked HttpOnly, injected script can read it and hijack the session, and the same injection enables phishing and redirection to attacker-controlled sites. All versions up to and including 4.4.2 are affected and the issue is fixed in 4.5.0; a public proof-of-concept is not referenced in the available data and there is no confirmed active exploitation (no CISA KEV listing), and the current priority is this_week.
Stack-based buffer overflow in Adobe Substance 3D Painter up to and including 12.1.5 allows arbitrary code execution in the context of the current user when a victim opens a crafted file. Severity is rated 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the local vector and mandatory user interaction constrain mass exploitation and favor targeted social-engineering delivery, and code runs only with the victim's privileges. No public exploit code or active exploitation is confirmed in the available data; the vuln.today decision label is this_week, indicating a genuine but not emergency-priority issue that should be scheduled for near-term remediation.
An out-of-bounds write in NVIDIA PhysX (versions 0.0 through 0.4.1.2, all platforms) allows memory corruption that could lead to code execution, data tampering, denial of service, or information disclosure. The CVSS 3.1 vector (7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confines the attack to a local path: no attacker authentication is required, but a legitimate user must open or otherwise process attacker-controlled PhysX content before the write can be triggered, so there is no unauthenticated remote trigger. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-reported case is prioritized as a this-week item rather than an emergency.
Arbitrary code execution in Autodesk Fusion builds 2705.1.30 through 2706.1.14 stems from the TextCommands.LoadDll command exposed by the Fusion API, which will load a maliciously crafted dynamic library from an arbitrary path. Exploitation requires local access plus user interaction: the victim must open or run attacker-supplied content (a script, add-in or project) that invokes the command against an attacker-controlled DLL, after which code runs at the privilege level of the current Fusion process with no privilege escalation step. No public exploit has been identified at time of analysis, and the vendor has released a fix in Fusion 2706.1.14; priority is rated this_week, a genuine but not emergency-grade issue.
Local privilege escalation in TeamViewer Remote Management Monitoring for Windows before 26.10.1: a low-privileged authenticated local user can impersonate the IPC broker and cause the Monitoring service to execute arbitrary code as NT AUTHORITY\SYSTEM. Only hosts with the Remote Management Monitoring component installed and its service running are affected (base TeamViewer remote-access installs without the Monitoring module are not indicated as affected by available data), and exploitation requires an existing low-privilege local session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N). This is a credible but non-emergency issue - no public exploit code or active exploitation is confirmed, and the vendor has released a fixed version (26.10.1).
Local privilege escalation to NT AUTHORITY\SYSTEM affects TeamViewer Full Client and Host for Windows builds prior to 15.82 (including the 13.2.x and 14.7.x branches and the 15.64.x legacy Windows 7/8 line), where improper access control in the Patch Management update mechanism lets a low-privileged, locally authenticated user forge an IPC response so a vendor-signed executable loads a malicious DLL planted in a user-writable temporary directory. The CVSS vector (AV:L/PR:L/UI:N, C/I/H) confirms this is strictly a post-compromise escalation: the attacker must already hold a foothold on the Windows host, and remote or pre-authentication triggering is not possible. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released fixed builds, so priority is this_week rather than emergency. Non-Windows TeamViewer builds are not in scope.
Local privilege escalation in TeamViewer Full Client and Host (prior to 15.83) and the Remote Management - Monitoring component (prior to 26.10.1) allows an authenticated low-privileged local user to execute scripts as SYSTEM/root by abusing improper access control on the IPC channel between the client/host and the monitoring component. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), successful abuse gives full confidentiality, integrity and availability impact on the affected host, but requires the attacker to already hold a valid low-privileged local account and presumes the Remote Management - Monitoring component is deployed. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; vendor-released fixes exist (15.83 for current Full Client/Host branches, 15.64.10 for legacy Windows 7/8 builds, and 26.10.1 for Remote Management - Monitoring) per TeamViewer bulletin TV-2026-1012.
Local privilege escalation in TeamViewer Full Client and Host for macOS lets a low-privileged local attacker exploit a TOCTOU race combined with symbolic-link handling in the privileged helper to bypass installer package verification and install a malicious package as root. Affected builds are prior to 15.83, plus 14.7.x before 14.7.48868 and 13.2.x before 13.2.154007; exploitation is local-only and requires winning the timing window. No public exploit was identified in the supplied sources at time of analysis, and the vendor has released fixed versions.
Local privilege escalation in Tanium End-User CX and the Tanium Endpoint Configuration Toolset Solution lets a user who is already logged on with low privileges raise their rights to a high-impact level (C:H/I:H/A:H) on the affected endpoint, with no user interaction required. Affected builds are end-user-cx releases up to 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 and 1.24.590, plus Endpoint Configuration Toolset Solution 1.51.60, 1.59.50 and 1.71.25; Tanium has released fixes for these branches. No public exploit was identified at time of analysis, and the weakness is classified as CWE-59 link following, although the sources do not describe the precise file or link condition that triggers it. The realistic exposure is a post-compromise scenario on an enterprise agent endpoint rather than a network-facing attack, which is why the priority is 'this_week' rather than emergency action.
Local privilege escalation in Tanium End-User CX and the Endpoint Configuration Toolset Solution allows an authenticated low-privileged user with local access to a managed endpoint to gain high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). The flaw is in the End-User Notifications component and is classified as CWE-59 link following; Tanium reports a vendor patch in advisory TAN-2026-058. This is a credible but non-emergency issue: no public exploit identified at time of analysis, no CISA KEV active-exploitation signal is present in the supplied data, and exploitation requires an existing local foothold.
A heap-based buffer overflow in Tanium's Index component (index-cx), also shipped within the Endpoint Configuration Toolset Solution, allows an attacker who already holds local access and low-level privileges on an endpoint to corrupt heap memory, with the potential for code execution at the integrity level of the affected Index process (CVSS 3.1: 7.8, AV:L/PR:L/AC:L, C/I/A all High, Scope Unchanged). Only hosts running the affected index-cx builds (3.9.x, 3.11.x, 3.14.x, 3.15.x, 3.16.x) or Endpoint Configuration Toolset Solution 1.51, 1.59 and 1.71 branches are exposed; the flaw is not reachable remotely or without credentials per the assessed vector. No public exploit code has been identified at time of analysis and there is no KEV listing, but Tanium has released fixed builds and the issue is prioritized for remediation this week.
Local privilege escalation in Tanium End-User CX (end-user-cx) and the Tanium Endpoint Configuration Toolset Solution lets an attacker who already holds a low-privileged local account on a managed endpoint leverage a link-following flaw (CWE-59) to gain high-integrity code execution, with CVSS 3.1 scoring 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only hosts running the pre-fix builds are exposed - end-user-cx below 1.8.47, 1.11.605, 1.19.325, 1.21.835, 1.22.1199, 1.23.766 or 1.24.590, and Endpoint Configuration Toolset Solution below 1.51.60, 1.59.50 or 1.71.25. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the vendor has released fixed builds, and the practical exposure is limited to endpoints that are already multi-user or already partially compromised.
Authenticated OS command injection in the Moxa OnCell G3150A-LTE cellular gateway (version 1.0.0 recorded as affected) lets a remote attacker who already holds administrative privileges on the device execute arbitrary commands by abusing insufficient input validation in the SMS management feature. The attack surface only exists when SMS management is enabled and configured, and the assessed CVSS 3.1 vector (7.5, AV:N/AC:L/PR:H/UI:N) confirms high privileges are required, so this is not a pre-authentication remote takeover. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 1.37% (72nd percentile) and the priority label is monitor, consistent with a conditional rather than mass-exploitation risk.
Impersonation of Moxa OnCell G3150A-LTE Series devices still using factory hard-coded keys is possible for unauthenticated remote attackers who obtain the shared key material, compromising confidentiality and integrity of management communications. EUVD lists version 1.0.0 as affected, and exposure is bounded to units that have not regenerated their cryptographic keys and to attackers able to meet the specific attack precondition and passive user interaction reflected in the assessed vector. No public exploit identified at time of analysis; EPSS is 0.30% (23rd percentile) and the priority is monitor.
Unauthenticated attackers can forge TiendaCrypto para WooCommerce payment webhooks - versions 1.0.1 through 1.2.1 - to mark arbitrary WooCommerce orders as paid, because the plugin validates the request signature against a key that is always empty. The exposure is narrow: it applies only where the webhook endpoint is reachable and the web server preserves the case of request header names, which is why it is scored 3.7 with AC:H and integrity-only impact. A public PoC reference exists (the WPScan entry); it is not verified as working exploit code, EPSS is 0.11% (1st percentile), there is no CISA KEV listing, and the priority label is monitor.
A malformed OGG/Speex audio file can trigger a heap buffer overflow in Asterisk's format_ogg_speex module, crashing the telephony process and causing denial of service. Affected versions are Asterisk 20.x before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1, and Certified Asterisk before 20.7-cert11 and 22.8-cert3. Exploitation requires a low-privileged or administrator-assisted file placement and Asterisk must be configured to play the crafted file; confirmed impact is a crash, and no public exploit was identified at time of analysis.
Back-office account takeover in Umbraco CMS (all versions before 17.7.2 and 18.0.0 through 18.2.1) lets unauthenticated attackers poison the Host header to register attacker-controlled OAuth redirect URIs for the back-office OpenIddict clients, then send a signed-in back-office user an authorization link using response_mode=form_post so the authorization code is delivered to the attacker, who redeems it with HTTP Basic client credentials. A successful chain yields an authenticated back-office session with the victim's privileges - full site control, and code execution through Razor templates if the victim is an administrator. Exploitation is conditional: it only works where the web server, IIS without host-name bindings, or a reverse proxy forwards requests for unrecognised host names to Umbraco, and it requires a logged-in operator to open the attacker's link (CVSS 3.1 AV:N/AC:H/PR:N/UI:R, vendor CVSS 4.0 7.7); no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor-released patches exist in 17.7.2 and 18.2.2.
Authenticated users of Hitachi Energy TRO600 series devices can abuse the product's port-forwarding capability to reach services that are bound only to localhost, bypassing the network access restrictions that are supposed to keep those services unreachable from the network. Successful tunnelling gives the attacker access to sensitive local functionality and confidential information, and the flaw also carries an availability impact; all firmware versions from 9.0.0.0 through 9.2.1.6 are listed as affected. Exploitation requires a valid authenticated session (CVSS PR:L) and conditions outside the attacker's full control (AC:H, AT:P), no public exploit has been identified at time of analysis, and the vendor's priority guidance places this in the moderate, address-this-week band rather than an emergency.
Authenticated users holding a privileged role in Hitachi Energy CoreTec 4 (3.0.0-3.4.0) and CoreTec 5 (3.0.0-5.0.0) can reach the configuration daemon's time-zone synchronization handler and inject operating-system commands, gaining full control over the device. The daemon builds a shell command from user-supplied time-zone input without any sanitization or validation (CWE-78), and the impact spans confidentiality, integrity and availability of the appliance itself. No public exploit code has been identified at time of analysis; exploitation requires valid credentials for an eligible role, and the vendor's high attack-complexity rating indicates an additional, undisclosed precondition.