Server-side request forgery (CWE-918) in NVIDIA TensorRT-LLM, reported by NVIDIA at CVSS 7.1, allows an attacker positioned with local or adjacent access to the inference host to make the service issue requests to attacker-influenced destinations, yielding high confidentiality impact and possible data tampering under a scope change. No authentication and no user interaction are required once that local/adjacent access is obtained, and AC:L means no special timing or configuration hurdle is described. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; the EUVD record lists TensorRT-LLM 1.3.0rc24 as affected and the vuln.today decision label is this_week.
Broken access control in REDAXO core before 5.21.4 allows an authenticated editor to redirect slice write operations at content they are not permitted to change, by pairing an article they are allowed to edit with the id of a slice belonging to another category. Deleting and toggling other editors' slices online/offline require the fewest additional permissions, while moving them needs the global moveSlice[] right and overwriting content additionally requires a matching module/template constellation. This is a moderate-priority, authenticated authorization flaw rather than a widespread emergency: exploitation needs a valid editor session with content permission on at least one category, no public exploit code has been identified at time of analysis, and the vendor has released REDAXO 5.21.4 as the fix.
Missing authorization in REDAXO's media pool bulk move (core releases through 5.21.3) lets authenticated backend users with permission for just one media category pull files out of categories they are barred from and then silently replace their contents everywhere those files are embedded. The bulk move validates only the target category, and because media permissions are flat while search (notably searchmode=global) lists files outside permitted categories as selectable checkboxes, no crafted request or victim interaction is required. Integrity impact dominates: replacement is constrained by matching file extensions, a MIME allowlist and SVG sanitisation, and deletion of in-use files is refused. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and vendor patches are available in 5.21.4, making this a this-week priority rather than an emergency.
Missing authorization in REDAXO core before 5.21.4 lets any authenticated backend user read the unpublished working version of any article by sending rex_version=1 to the structure/version preview, and lets users holding the history[article_rollback] permission read historic snapshots, including content that has since been deleted, through the structure/history preview using rex_history_date. Impact is confidentiality only; the article and clang are taken from freely chosen request parameters and can be enumerated, so exposure is systematic rather than a single object. No public exploit code has been identified at time of analysis, and the vendor-released fix is version 5.21.4.
Cross-site request forgery in Semantic MediaWiki's Special:SMWAdmin page allows an attacker to drive destructive maintenance actions - table schema setup (action=updatetables), entity disposal, and job enqueue or stop - through the browser session of a logged-in user holding the smw-admin right, producing semantic data loss, schema disruption and resource exhaustion. The flaw covers releases from 3.0.0 before 7.3.1; the vendor advisory confirms 7.3.0 and 7.3.1-alpha at revision 61805acbab50e2ffd4f75ebbb23ee9695c191fb8, with the corrected package `composer/mediawiki/semantic-media-wiki` fixed in 7.3.1. Exploitation is not self-service: the attacker is unauthenticated but must lure a privileged administrator to a malicious page while the targeted maintenance feature is enabled, so the practical exposure is bounded; the advisory publishes a source-predicted PoC HTTP request (not verified as working exploit code), no active exploitation is confirmed (not in CISA KEV), and the priority call for this CVE is patch within this week.
Semantic MediaWiki 2.5.0 through 7.3.1-alpha applies annotation-driven page protection without any authorization check, so an ordinary editor who can already edit an unprotected page in a semantic-enabled namespace can add [[Is edit protected::true]] and have indefinite edit and move restrictions imposed at the configured $smwgEditProtectionRight - a right the editor does not hold. The effect is a persistent denial of edit and move to other contributors, potentially including administrators who lack the configured SMW right, rather than any disclosure of data. Exposure is narrow: the feature is disabled by default and only wikis that deliberately enabled $smwgEditProtectionRight are affected, and while the vendor advisory documents an offline, network-isolated PHP harness confirming the updater's behavior, no end-to-end exploit against a live wiki is referenced and there is no KEV listing.
OS command injection in the tmpServer/TDDPv1 service of the TP-Link RE305 V3 range extender lets a low-privileged local attacker run arbitrary operating-system commands as root on the device. The service listens only on the local loopback interface, so the attacker must already hold some on-device execution foothold; there is no network-reachable path and no scope change beyond the extender itself. No public exploit code was identified at time of analysis, and TP-Link has released firmware 1.1.8 Build 20260921 Rel. 42853 that removes the flaw, making this a moderate, situational priority (patching this month) rather than an emergency.
Race condition in the a2a-js Task Status Update Handler (versions 1.0 and 1.1.0) lets a remote caller have a task cancellation overwrite a status written by a concurrently finishing executor - or have the CANCELED write lost - corrupting the persisted task record. The window exists because cancelTask on the no-event-bus path of DefaultRequestHandler performs load→check→mutate→save without taking the per-(tenant, owner, taskId) write lock or checking whether the task has already reached a terminal state. Impact is confined to task integrity and availability (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:L); exploitation is non-deterministic, requiring a narrow timing race against the executor's completion, and no public exploit code was identified at time of analysis. Rated this_month priority - a medium-severity integrity/availability issue rather than an emergency.
REST API authentication in Veeam Backup for Microsoft 365 8.0 through 8.6.0.1102 can be bypassed by a remote, unauthenticated attacker using a forged federation token, but responses are limited to endpoints that do not call the backup service. That confines impact to low confidentiality exposure on that endpoint subset, with no integrity or availability impact and no access to backup-service operations. The issue is rated CVSS 6.9, no public exploit was identified at time of analysis, and the precise cryptographic verification flaw is not described in the available sources.
Heap-based buffer overflow in DevilutionX 1.4.0 through 1.5.5 corrupts memory when the engine loads a crafted MPQ archive whose block table count exceeds its hash table count, overflowing a memcpy inside the bundled libmpq libmpq__archive_dup routine during startup; the confirmed outcome is a crash of the game (availability impact, no confidentiality impact and no demonstrated code execution). Exploitation is local: an attacker must first place the malicious archive in the game data the engine reads at startup, and the victim must then launch the game, so passive user interaction is required and no privileges are needed on the victim side. The issue is rated medium (CVSS 4.0 6.9, independently assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R with A:H only), EPSS is 0.13% (3rd percentile), it is not in CISA KEV, and no confirmed public exploit code has been identified at time of analysis - the only public material is a technical write-up. Priority guidance places it at this_month rather than emergency.
Integer overflow in llama.cpp's GGUF loader (gguf_init_from_reader) lets a crafted model file defeat the size validation added for CVE-2025-53630: a tensor whose computed byte size lands near SIZE_MAX pads to zero, so the loader accepts an undersized data blob that downstream consumers then read past. Builds b5854 up to but not including b11275 are affected, along with the corresponding 0.1.0 to before-0.6.0 semver range. Exploitation requires a victim to open a malicious GGUF file (local attack vector, user interaction, no authentication), and impact is bounded to out-of-bounds reads - crashes, denial of service, and limited information disclosure - rather than code execution; exploitation is not observed in the wild (SSVC exploitation: none) and EPSS is low at 0.13% (2nd percentile), with the vendor fix shipping in b11275.
Out-of-bounds memory access in llama.cpp builds b10398 through b11300 arises because a crafted GGUF model file can declare tensor dimensions whose product overflows INT64_MAX and wraps to zero, slipping past the element-count validation in gguf_init_from_reader so that ggml_nbytes() and stride calculations size buffers far too small. The flaw is only reachable when a vulnerable build loads and parses an attacker-supplied model: the assessed vector is local (AV:L) with user interaction required (UI:R), so there is no remote, network-triggered or unauthenticated path, and risk is concentrated in workflows that ingest third-party GGUF artifacts such as model hubs, shared storage, or services accepting user-uploaded models. Exploitation yields limited confidentiality and integrity impact with a high availability impact, but no public exploit code has been identified at time of analysis, EPSS is only 0.13% (2nd percentile), and the issue is not in CISA KEV; a vendor patch is available in b11301 and the prioritization signal is this_month rather than act_now.
Hard-coded AES-128 key and IV values in TP-Link RE305 V3 and Archer C7 V5 configuration backups allow anyone who obtains an exported backup file to decrypt it and recover administrator passwords and Wi-Fi credentials. Affected firmware is RE305 V3 before 1.1.8 Build 20260921 Rel. 42853 and Archer C7 V5 before 1.3.1 Build 20260821 Rel. 41256; exploitation requires possession of a backup file and has no remote path against a running device (CVSS 4.0 base 6.9, local vector). Vendor patches are available, and no public exploit was identified in the supplied intelligence at time of analysis.
Local privilege escalation in the Asterisk PBX `ast_loggrabber` diagnostic script lets an attacker who already holds an interactive shell account on the Asterisk server plant a malicious Python helper in the world-writable `/tmp` directory, which is then executed if an administrator later runs `ast_loggrabber` as a user with elevated privileges. Affected builds are Asterisk up to and including 20.20.0, 21.12.2, 22.10.0 and 23.4.0, plus Certified Asterisk up to 20.7-cert10 and 22.8-cert2; fixes are published in 20.20.1, 21.12.3, 22.10.1, 23.4.1, 20.7-cert11 and 22.8-cert3. Exploitation is constrained by two preconditions that must both hold - existing authenticated shell access and a privileged manual invocation of the diagnostic script - and there is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV) and no EPSS signal supplied in the available data.
Repeated remote Cancel requests against a2a-go's Distributed Manager can leak resources and degrade availability in versions 2.0 through 2.4.0. When the ContextCodec fails to encode context during a Cancel call, the handler returns the error without closing the associated event-queue reader, so each failed cancellation strands a reader; sustained triggering can exhaust resources and produce a denial of service. The issue is reachable by remote, unauthenticated callers of a service that exposes the Cancel operation (per the assessed AV:N/PR:N vector), but availability impact is rated low and exploitation depends on the encode-failure branch being forced repeatedly. Version 2.5.0 fixes the leak, and no public exploit code has been identified at time of analysis.
Resource exhaustion in the a2a-go A2A SDK (versions 2.0 through 2.4.0) allows an unauthenticated remote client to leave server goroutines permanently parked in the REST server-sent-events streaming handler. The trigger shown by the vendor's regression test is a sequence rather than a single packet: the client disconnects, the main select loop in handleStreamingRequest returns, and the event-producing goroutine then panics and blocks forever trying to send on a panic channel that no longer has a reader. Impact is availability-only and incremental - each occurrence leaks resources instead of causing instant denial of service - no public exploit code was identified at time of analysis, and the vendor has released a fix in v2.5.0.
Unauthenticated remote access to service functionality in BMC Control-M/Enterprise Manager and Control-M/Server 9.0.20 up to but excluding 9.0.22 can expose information or degrade service availability, with low confidentiality, integrity and availability impact and no scope change (CVSS 4.0 base 6.9; assessed CVSS 3.1 7.5-equivalent vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Per the CVSS vector, no credentials (PR:N) and no user interaction (UI:N) are required once the affected service is reachable, so exposure is governed primarily by whether the Control-M instance is network-accessible to untrusted clients; earlier unsupported versions are also listed as potentially affected. Exploitation status: no public exploit identified at time of analysis, and the issue is not in CISA KEV. Vendor-released patch: 9.0.22 for both Control-M/Enterprise Manager and Control-M/Server.
Unauthenticated path traversal in EasyImages2.0 (versions 0 through 2.8.6) lets a remote attacker read files outside the configured upload directory by sending '../' sequences in the dw, history, or img parameter of app/down.php, app/thumb.php, or app/info.php. No credentials, user interaction, or special configuration are required against a default install, but disclosure is bounded: the application only serves files whose extension is in the allowed upload-extension set, so exposure is limited to files carrying an image-like extension rather than arbitrary server files, which is why the impact is scored as low confidentiality only (CVSS v4.0 6.9; assessed CVSS:3.1 6.9 with C:L). The flaw is tracked as EUVD-2026-110844 and reported by VulnCheck; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, with the vuln.today priority label indicating remediation this month.
Unauthenticated server-side request forgery in Artalk versions before 2.10.1 lets remote attackers make the comment server fetch attacker-chosen URLs by submitting an anonymous comment to /api/v2/comments with page_key set to an internal or external address. The fetched resource's HTML title is then exposed through the public comment list, giving an attacker title-level read access to internal endpoints; the trigger is confined to deployments that perform automatic page-title fetching on comment submission, and the independent assessment rates the impact as limited-confidentiality (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and vendor patches are available in the 2.10.1 release.
Authorization bypass in RSSAnt 1.9.0 through 1.9.1 lets unauthenticated attackers read stories from feeds whose owners never published them, by calling the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, a request carrying any valid publish unionid in the X-RSSANT-PUBLISH header plus an enumerated feed_id and offset returns private feed story content instead of the expected 'does not exist' rejection. Exposure is conditional on the instance's publishing feature being enabled by at least one user, and the attacker must guess encoded unionid feed identifiers and offsets; impact is limited to confidentiality of unpublished feed content with no integrity or availability effect, and no public exploit code or active exploitation was identified at time of analysis.
A stack out-of-bounds read in SDL_image's ILBM/LBM loader (IMG_LoadLBM_IO in src/IMG_lbm.c) lets a crafted image with the HAM flag set and more than 8 bitplanes drive the palette loop past the 256-entry colormap stack array, crashing the host application and potentially leaking adjacent stack memory. Both branches are affected: 3.0.0 through 3.4.8 and 0 through 2.8.12. The impact is a read primitive only, so the realistic worst case is denial of service plus limited information disclosure rather than code execution; exploitation requires an application using the library to open the attacker-supplied file (UI:P, AV:L, PR:N - unauthenticated), and no public exploit was identified at time of analysis. Vendor fixes are published as upstream commits 5cfbe85f3a783417eec4d5aa0660b40c2cff5292 and 9c0622c36cf01e9ecba4bfdd6c4aa2b21c8cf996, which add explicit HAM bitplane validation.
Loading a crafted BMP with CImg 4.0.6 or earlier can crash the host application and copy heap memory into the decoded image, because the BMP loader's row byte-count computation in _load_bmp() overflows on an oversized header width. The flaw is a local, file-processing vector: an application must invoke CImg's BMP decoder on attacker-supplied data (CVSS 4.0 AV:L/UI:P, PR:N), and impact is limited to availability loss plus low-confidentiality heap disclosure, with no integrity or code-execution path indicated. No public exploit or CISA KEV entry is associated with this CVE at time of analysis, an upstream fix commit is available, and the issue is assessed as moderate priority ('this_month') rather than an emergency. CImg is a header-only C++ library, so every project that vendors a copy of CImg.h inherits the exposure until it recompiles against the patched header.
Uncaught exception in svg-sanitizer (the enshrined/svg-sanitize Composer package) versions 0.11.0 through 1.0.0 lets remote attackers crash PHP workers with well-formed XML documents that lack exactly one top-level <svg> root. Because Sanitizer::sanitize() builds an XPath object without a try/catch on the documented 'returns false on bad input' path, a non-svg root, a zero-svg document, or an <svg> nested under another root throws an uncaught LogicException instead of returning false - a PHP fatal error or HTTP 500 per request, and potentially a skipped upload-rejection branch. Severity is limited to availability (CVSS v4 6.9 with A:L; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/A:L); there is no confirmed active exploitation (not in CISA KEV) and no public exploit code confirmed working, though a public PoC reference exists in the advisory and the SSVC 'Automatable' rating is yes. Only callers that wrap sanitize() in a broad catch or guard solely on === false are exposed.
Missing authorization in the Semantic MediaWiki smwtask API module allows unauthenticated remote visitors to invoke maintenance operations that the wiki reserves for administrators, affecting releases 3.0.0 through 7.2.1. A caller can read internal store statistics and object-ID space, enqueue arbitrary Semantic MediaWiki jobs, and force synchronous execution of queued jobs, degrading performance and, via entity-disposal tasks aimed at enumerated IDs, altering stored semantic data - with impact scaling to how populated and how large the wiki's store is. There is no confirmed active exploitation (not in CISA KEV; SSVC exploitation is 'none'), though the vendor advisory includes reproduction proof-of-concept requests and exploitation is automatable; the vendor fix is 7.3.0.
Semantic MediaWiki 7.3.0 through 7.3.1-alpha fails to authorize the target page in its smwtask update task, letting a caller holding the wiki-wide edit right force semantic updates on arbitrary page titles. The caller supplies a serialized subject that is deserialized and passed to a forced UpdateJob without a title-level edit check, so the task can trigger reparsing, semantic-store writes, cache invalidation and expensive dependency work on pages outside the caller's authorization boundary; on wikis that permit anonymous editing, anonymous users may hold that edit right. A safe proof-of-concept request is documented in the vendor advisory but is a staged verification recipe, not confirmed working exploit code, and no active exploitation is confirmed; this is a genuine but moderate-priority issue, not a top-tier emergency.
Missing authorization in Semantic MediaWiki 7.3.0 lets unauthenticated remote callers run queued maintenance jobs of arbitrary type and unbounded count and force semantic-store updates for any title, including pages protected to sysop, through the smwtask API module. The per-task authorization model introduced in 7.3.0 maps run-joblist, update and check-query to the MediaWiki 'edit' right, which anonymous users hold on a stock wiki, and the module's CSRF requirement is satisfied by the fixed public anonymous token '+', so no session or credentials are needed; the four administrator tasks stay correctly denied, so an attacker can run already-queued jobs but not enqueue new ones. Fixed in 7.3.1; a public PoC reference exists in the vendor advisory as verbatim request transcripts (not verified as working exploit code), no KEV entry is associated, and the vuln.today priority is this_month rather than act_now.
Credential disclosure in Symantec Ghost Solution Suite's GSS Deployment Server lets an attacker who possesses the product's hardcoded cryptographic key decrypt domain and service-account passwords, task run-as credentials and sysprep passwords that the component stores or transmits. The builds identified by EUVD are GSS 3.3.13, GSS 3.3 RU11 and GSS 3.3 RU12 (CPE cpe:2.3:a:broadcom:symantec_ghost_solution_suite), and exploitation is limited to attackers with an adjacent-network position who can also obtain the credential ciphertext - either by intercepting passwords sent by the Deployment Server or by reading the encrypted credential store on an installation. Severity is rated 6.8 under CVSS 4.0 (independent assessment: CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L); there is no KEV listing, no public exploit identified at time of analysis, and EPSS is 0.15% (4th percentile).
An out-of-bounds read in the libmpq library bundled with DevilutionX 1.4.0 through 1.5.5 lets a crafted .mpq archive crash the game: the file-number lookup routine libmpq__file_number_from_hash uses an unchecked block_table_index from the archive's hash table to index the block table array, reading past the heap buffer (mpq_map) and terminating the process. The attack is not remote - the attacker must first get a malicious archive into the game's data path (for example distributed as a mod) and the victim must then launch DevilutionX and load it, so a legitimate install using only official Blizzard data is not affected. Per the assessed impact the consequence is availability only (crash), with no confidentiality or integrity effect; there is no CISA KEV listing, EPSS is low at 0.12% (2nd percentile), and no working public exploit code is confirmed, although a public technical write-up of the flaw exists.
A heap out-of-bounds read in llama.cpp's vocabulary loader (llama_vocab::impl::print_info) lets a crafted GGUF model crash llama-cli or llama-server during model load; it affects builds prior to b5649. Unauthenticated remote attackers cannot trigger it on their own - the operator must be induced to load an attacker-supplied model (CVSSv4 UI:P, assessed CVSSv3.1 AV:L/UI:R) - and the only demonstrated impact is process termination, with no confidentiality or integrity effect and no code execution shown. A public PoC reference exists; it is not verified as working exploit code. No KEV listing, EPSS 0.12% (2nd percentile), and the vendor fix is available as build b5649, so this is a genuinely medium-tier issue that should not be treated as an emergency and is scheduled for this month's patch cycle.
Kernel-level privilege holders on affected ASUS motherboards can supply an arbitrary memory address through an I/O command to the board firmware, which then dereferences the untrusted pointer, allowing tampering with system information or crashing the system. The flaw is local-only and requires high privileges (ring-0) to reach, so it is not remotely or unauthenticated-reachable; integrity and availability are impacted while confidentiality is untouched. No public exploit code or active exploitation has been identified at time of analysis, EPSS is negligible (0.11%, 1st percentile), and ASUS has published fixed firmware per board series.
Dell PowerProtect Data Domain appliances running Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20 contain an improper privilege management flaw that lets a remote attacker who already holds a high-privileged account elevate privileges. The CVSS 3.1 score is 6.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H), and Dell has released fixed versions 8.9.0.0, 8.3.1.50, 8.6.1.30, and 7.13.1.90. No public exploit was identified at the time of analysis, and the requirement for high-privileged credentials limits exposure.
Command injection in Supermicro MBD-X12SPI BMC/IPMI firmware 01.07.20 allows a holder of IPMI administrator credentials to execute arbitrary commands as the operating system root user on the BMC. The flaw is reachable over the network without user interaction, but exploitation requires prior administrative access to the IPMI interface, making it a privilege-escalation path from BMC admin to OS root rather than an unauthenticated takeover. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS is 0.54% (45th percentile), indicating low predicted exploitation activity.
Command execution in JetBrains Junie CLI before 26.8.17 can occur because the command allowlist does not fully validate entries, allowing a command to bypass the intended restriction. This is a moderate-severity, context-dependent issue rather than an emergency: the vector is local, requires low-level host privileges, mandatory user interaction to run the agent, and high attack complexity, and only versions below 26.8.17 are affected. No public exploit has been identified at the time of analysis, and the vendor has released a fixed version.
Sensitive information disclosure in Tanium Reputation allows confidential data handled by the module to be written into Reputation log files, where a party able to read those logs can recover it. Deployments running Reputation 6.6 before 6.6.145, 6.7 before 6.7.138, or 6.8 before 6.8.162 are affected; the assessed vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) confines realistic impact to confidentiality loss for an authenticated, highly privileged party that already has log access, rather than to integrity or availability damage. No public exploit code has been identified at time of analysis, and vendor-released patches exist for all three affected branches.
An incorrect privilege assignment flaw (CWE-178) in Tanium Server allows a network-positioned attacker who already holds high privileges on the platform to gain full confidentiality, integrity and availability impact (C:H/I:H/A:H) by meeting a high-complexity precondition that is not detailed in the available sources. Affected releases are Tanium Server below 7.7.3.8351, below 7.8.2.1263 and below 7.8.4.1399; Tanium has published advisory TAN-2026-054 and fixed versions for each branch, so the exposure is limited to unpatched deployments. The vector requires PR:H and AC:H, meaning opportunistic or unauthenticated exploitation is infeasible from this data, and the vendor-reported severity is moderate at CVSS 6.6; no public exploit code or CISA KEV listing is present in the available intelligence, and the priority decision is 'this_month'.
Psono Server 5.3.5 through 7.2.3 allows an attacker who already holds an authenticated session derived from a scope-restricted API key to escalate privileges by claiming an attacker-controlled device code, receiving in return a full read-write session valid for up to 365 days that outlives and exceeds the original token's scope and lifetime limits. The flaw is a missing write-scope enforcement in the permission class on the device-code claim path (CWE-269), rated CVSS 6.5 with PR:L, and it does not bypass two-factor authentication nor directly disclose plaintext secrets. It is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; EPSS is low at 0.47% (40th percentile), and the vendor has released a fix in 7.2.4.
Psono Server CE and EE (versions 3.1.0 through 7.2.3) fail to consume the stored WebAuthn challenge after verifying an assertion, enabling a replay of a captured WebAuthn assertion against separate login token requests as long as that stored challenge remains unchanged. The practical effect is a bypass of the WebAuthn second factor, but only for an attacker who already holds the victim's valid password and has captured one valid assertion; the flaw itself does not disclose plaintext secrets. Severity is moderate (CVSS 6.5, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) with a low EPSS of 0.41% (35th percentile); no public exploit code and no confirmed active exploitation are indicated in the available data.
Memory exhaustion in the shared knative.dev/pkg admission webhook handler allows a pod-network attacker to OOM-kill any controller built on the library by sending one oversized POST to its admission endpoint. All knative.dev/pkg versions prior to 0.0.0-20260531000007-52dbd5ece63f are affected, and the flaw propagates to every downstream consumer of the shared webhook server - Knative Serving and Eventing, Tekton Pipelines and Triggers, KEDA, Sigstore policy-controller and Kpack - because none of them bound the request body before decoding. Impact is availability-only: with failurePolicy=Fail the OOM becomes a namespace or cluster admission outage, with failurePolicy=Ignore only the affected webhook goes offline; the advisory includes a reproduction script and measured memory-amplification logs, but there is no public exploit identified at time of analysis in the sense of confirmed attack activity and the issue is not in CISA KEV. A vendor patch is available, and the assessed priority is to remediate this month rather than as an emergency.
Broken role-based access control in Grafana 13.0.x through 13.1.x lets an authenticated user who holds dashboard permission-management rights on just one folder be treated as a folder administrator for all folders when listing deleted dashboards. That incorrect authorization decision exposes deleted dashboard listings from folders the user was never granted administrative rights over, although it does not grant broader folder administration or modification capability. The flaw is rated moderate by the vendor and by independent assessment (access-control weakness, confidentiality-only impact); no public exploit code has been identified at time of analysis and CISA KEV does not list it.
Denial of service in Dell PowerProtect Data Domain (Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.70, LTS2025 8.3.1.0 through 8.3.1.30, and LTS2026 8.6.1.0 through 8.6.1.10) can be triggered through crafted certificate content processed by the appliance, where a relative path traversal (CWE-23) is possible. Exploitation requires an authenticated session with high-privilege, administrative access to the appliance over the network (CVSS PR:H); no user interaction is required, and the assessed impact is primarily to availability, with the trigger not detailed in the available sources. The issue is rated CVSS 6.5 (medium) with the real-world risk substantially gated by its administrative prerequisite; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), with vendor fixes available and prioritised for remediation this month.
MLflow's CrewAI autologging integration records CrewAI Agent objects without sanitizing nested credential-bearing values, so provider API keys held in an Agent's LLM object are written in plaintext into span attributes and mlflow.spanInputs. Applications running MLflow 2.19.0 through 3.16.x that explicitly enable mlflow.crewai.autolog() with a CrewAI Agent created via LLM(api_key=...) can therefore send plaintext credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. Exploitation is confirmed feasible by the upstream advisory's reproduced proof of concept, and the vendor released a fix in MLflow 3.17.0; signals point to a genuine but moderate, non-urgent credential-exposure issue rather than a high-impact remote compromise.
Denial of service in Tanium Enforce allows an authenticated low-privileged user with network reachability to the Enforce component to crash the service through a null pointer dereference (CWE-476), rated CVSS 6.5 with availability impact High and no confidentiality or integrity effect. Affected deployments are Enforce 2.9 before 2.9.736, Enforce 2.10 before 2.10.778, and Enforce 3.0 before 3.0.373, and the vendor (Tanium, TAN-2026-074) has released fixed builds for each branch. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation is confined to users who already hold valid credentials on the Tanium platform.
Tanium Stream Client Extension (cx-stream) and Endpoint Configuration Toolset Solution do not properly validate certificates on the connections they initiate, so an attacker who can intercept or relay TLS traffic can impersonate the peer and disclose information (CVSS 6.5; C:H/I:N/A:L). The issue is unauthenticated (PR:N) and requires no user interaction (UI:N), but exploitation depends on a man-in-the-middle network position, which is reflected by AC:H; no public exploit has been identified at time of analysis. This is a moderate-severity, this_month-priority issue rather than an emergency, and vendor fixes are available per Tanium advisory TAN-2026-060.
An authenticated SQL injection (CWE-89) in the Tanium Patch module lets a low-privilege user with valid console credentials and network access to the Patch component read data they should not be able to reach, with confidentiality impact rated High and no integrity or availability effect (CVSS 6.5, PR:L, UI:N). Deployments running Patch 3.24 before 3.24.306, 3.28 before 3.28.325, or 3.32 before 3.32.353 are affected. No public exploit code and no confirmed active exploitation were identified at the time of analysis; the authentication prerequisite confines practical exposure to insiders or attackers who already hold a foothold.
Prototype pollution in the npm systeminformation library (versions up to and including 5.33.12) lets unauthenticated remote attackers who control the ifaces argument to networkStats() write seven fixed properties onto Object.prototype, but only on FreeBSD, OpenBSD and NetBSD hosts where the application forwards untrusted input and the underlying netstat call succeeds. The impact is bounded and application-specific: wrong branching, extra enumerable keys in for...in serialization, configuration merging, validation and lookup collisions, with low integrity and availability impact rather than known remote code execution. A public PoC reference exists; it is not verified as working exploit code, and this is assessed as a moderate, not emergency, priority.
An authenticated SIP peer can crash Asterisk by sending a single crafted SIP NOTIFY request whose Message Waiting Indication (MWI) body over-reads a buffer in the PJSIP MWI body parser, terminating the process and dropping all calls and registrations handled by it. The attacker must first satisfy Asterisk's SIP authentication, either with valid endpoint credentials or by sending from a source IP that matches an endpoint's permitted address, so exposure is limited to deployments using the PJSIP stack that process MWI NOTIFY requests. Asterisk versions up to 20.20.0, 21.12.2, 22.10.0 and 23.4.0 and Certified Asterisk up to 20.7-cert10 and 22.8-cert2 are affected; fixes are released in 20.20.1, 21.12.3, 22.10.1, 23.4.1, 20.7-cert11 and 22.8-cert3, and no public exploit has been identified at time of analysis. Impact is availability only (CVSS 6.5, A:H) - there is no code execution or data exposure.
Dell PowerProtect Data Domain backup appliances are exposed to an improper access control flaw (CWE-284) that an unauthenticated remote attacker can use to disrupt availability, with partial integrity impact and no confidentiality impact. Affected releases are Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; CISA SSVC rates exploitation as none with automatable trigger and partial technical impact, and the vendor has released fixed builds.
Stored cross-site scripting in the Jupiter X Core plugin for WordPress (all versions up to and including 4.61.0) allows authenticated users with contributor-level access or higher to persist arbitrary script through the 'forget_password_link' parameter of the Raven login form widget, which then executes in the browser of anyone who loads the injected page. Severity is moderate (CVSS 6.4) because the attacker must already hold a trusted, logged-in account and a victim must later visit the affected page; scope is marked as changed since the script runs in the wider site context. The issue is not listed in CISA KEV and no public exploit code was identified in the available data, with EPSS at roughly 0.19% (9th percentile) and a triage label of this_month.
Authenticated server-side request forgery in HomeBox before 0.27.0 lets any member of a collection point a generic notifier at a permitted host that then 302/307/308-redirects to loopback, link-local, RFC1918 or cloud-metadata addresses, because the redirect hop is followed without re-running the product's SSRF policy. The flaw is reachable immediately through POST /api/v1/notifiers/test and asynchronously through stored notifiers during scheduled maintenance delivery, giving low-impact read/write access to internal endpoints (CVSS 6.4, PR:L, scope-changed). No public exploit code or KEV listing was identified at time of analysis, and the vendor shipped a fix in 0.27.0.
Second-factor bypass in the Roundcube twofactor_gauthenticator plugin allows an attacker who already holds a victim's account password to skip the 2FA prompt by spoofing a whitelisted source address through attacker-controlled Client-IP or X-Forwarded-For headers. Exploitation is conditional: the plugin's IP-whitelist/trusted-address feature must be configured to skip 2FA for certain addresses, and the deployment must accept and trust client-supplied forwarding headers rather than having a reverse proxy strip or overwrite them. Severity is medium (CVSS 6.3, CWE-290), EPSS is low at 0.48% (41st percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and a fix is available in upstream commit 4640889.