Local privilege escalation in GFI KerioConnect's KOFF Outlook Connector (Offline Edition) before 10.0.9 Patch 2 lets a non-administrative local user on a Windows host replace the searchd.exe binary used by the bundled KOFFIndexingService, which runs as LocalSystem, gaining NT AUTHORITY\SYSTEM code execution when the service next starts or the machine reboots. The root cause is CWE-276 incorrect default permissions: the installer leaves the product directory writable by the built-in Users group, so the swap requires only file-write access a standard account already has. Requires local access with low privileges (CVSS 4.0 PR:L, AV:L) and an affected KOFF installation; there is no network vector and closing the hole is a matter of upgrading to 10.0.9 Patch 2 or correcting the directory ACLs. No public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
Blind SQL injection in Advanced Ads - Tracking before 4.0.0 allows an authenticated low-privileged user to extract data from the WordPress database through unneutralized input, with confidentiality as the assessed impact. The plugin must be installed and active, and the assessed vector requires a low-privileged account (PR:L), so fully unauthenticated visitors are not covered. No public exploit or CISA KEV entry is identified at time of analysis, and the vendor fix is version 4.0.0.
SQL injection in the BuddyPress WordPress plugin through 14.5.2 lets authenticated low-privilege users reach the database and read sensitive information, with a CVSS 3.1 score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). Any registered community member can meet the PR:L prerequisite, so sites with open registration or self-signup are more exposed, while sites that restrict account creation reduce the attack surface. No public exploit was identified at time of analysis, and Patchstack rates the issue as this_week priority - a credible, above-average-priority issue but not an emergency.
SQLite SQL injection in Tabularis (TabularisDB) before 0.28.0 lets an MCP client - including an AI agent steered by untrusted content it is processing - execute arbitrary stacked SQL statements through the describe_table tool's table_name argument, reading, modifying or dropping SQLite data entirely outside the product's read-only mode and write-approval gate. Only SQLite connections exposed through Tabularis's built-in MCP server are affected; the MySQL and PostgreSQL drivers use bound parameters and are not vulnerable. The CVE record scores it 8.5 under CVSS v4.0, while our independent CVSS v3.1 assessment scores it 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because exploitation is local-only (stdio JSON-RPC, no network socket) and requires an agent session to actually issue the describe_table call. A working proof of concept is published in the GitHub security advisory GHSA-xrx3-j98v-67x9 - the reporter reproduced the stacked-statement execution against libsqlite3 via a ctypes harness rather than the shipped Tauri binary, so a public PoC reference exists but has not been demonstrated end-to-end against a released build; there is no CISA KEV listing and no public evidence of active exploitation at time of analysis. Per the current priority signal this is scheduled for remediation this week rather than treated as an emergency.
Client identity spoofing in OAuthLib before 4.0.0 allows an authenticated, lower-privilege confidential client to have its grant type and scope checks evaluated against a different, higher-privilege client's ID, potentially yielding access tokens carrying grants and scopes that were never assigned to it. The flaw exists in the client_credentials and Resource Owner Password Credentials token grant handlers, where the authenticated client object is stored in request.client but an attacker-supplied client_id from the request body is retained and passed as the first-class client_id argument to validate_grant_type() and validate_scopes(). Only deployments whose RequestValidator authorizes from that client_id argument are exposed; validators that authorize exclusively from request.client are not affected, and the attack cannot be performed unauthenticated, so practical exposure is limited to providers that host multiple clients with differing privilege levels. Fixed in version 4.0.0; the upstream GitHub advisory (GHSA-7984-qgvg-3j9c) includes a public proof-of-concept reproducer script against oauthlib 3.3.1, and there is no CISA KEV listing or confirmed in-the-wild exploitation in the supplied intelligence.
Stored cross-site scripting in n8n allows an authenticated member who can create and activate workflows to serve attacker-supplied HTML from webhook response paths that skip n8n's sandbox Content-Security-Policy, so the markup executes on the n8n origin and can act with the session of any user who opens the webhook URL. The flaw affects releases before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1, and is fixed in 1.123.85, 2.43.5, and 2.44.1. Exploitation requires a member-level account plus a victim who opens the crafted webhook URL, making the practical risk highest in shared or multi-tenant instances rather than single-user or fully trusted deployments; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is rated this_week priority.
A DOM-based cross-site scripting flaw in Highcharts Grid lets an attacker who can influence the Grid configuration set credits.href to a javascript: URL, so clicking the credits link executes attacker script in the hosting page's origin with access to that application's data, storage and session state. Affected are @highcharts/grid-pro 2.0.0 through 3.1.0 and @highcharts/dashboards 3.2.0 through 3.6.0; the vendor fixed Grid Pro in 3.2.0 and Dashboards in 4.0.0. Exploitation requires two conditions to both hold - untrusted data must reach the Grid configuration, and a user must actively click the credits link (the vector rates low privileges, PR:L, and active user interaction, UI:A) - and no public exploit has been identified at time of analysis, though the issue is triaged for remediation this week.
DOM-based cross-site scripting in Highcharts Dashboards edit mode lets markup placed in the fullscreen language labels execute as script in the hosting page's origin, giving the injected code the same access to page data, storage and session state as the dashboard application itself. The flaw affects the @highcharts/dashboards package from 1.0.0 onward; the vendor advisory states it is fixed in 4.2.3 (the embedded npm package record lists a fix in 4.2.2), and the upstream commit replaces innerHTML with textContent in Fullscreen.setButtonText. Exploitation is constrained: the attacker must control the Dashboards language configuration (PR:L), edit mode must be enabled with viewFullscreen among the context-menu items, and a user must render the control (UI:A), so the trigger surface disappears entirely in deployments that leave edit mode disabled. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis; the priority label is this_week.
Improper neutralization of HTML in the Highcharts Dashboards edit-mode sidebar lets markup supplied through the Dashboards language configuration execute as script in the origin of the page hosting the dashboard. Only deployments running @highcharts/dashboards 1.0.0 through 4.2.2 with Edit Mode enabled are exposed, and the attacker must both control the sidebar language strings (authenticated, PR:L) and persuade a user to open the edit-mode sidebar (UI:R). A public PoC reference is not present in the available data and no public exploit has been identified at time of analysis; fixing to 4.2.3 replaces the HTML sink with text insertion and removes the exposure.
Cross-site scripting in Highcharts JS (Core, plus the Stock, Maps and Gantt builds shipped from the same package) affects versions 5.0.0 through 13.0.2: the chart's credits.href option is assigned directly to window.location when the credits label is clicked, with no check against the library's allowed-scheme list, so a javascript: URL supplied through chart configuration executes in the origin of the page hosting the chart. Exploitation needs two things at once - untrusted data reaching the credits.href option (for example a chart rendered from user-supplied config) and a user actually clicking the credits label - which limits exposure to deployments that build chart options from untrusted input; static or trusted configurations are not exploitable. The reporter scored this 8.4 under CVSS 4.0, an independent assessment puts it at CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, no confirmed in-the-wild exploitation or KEV listing is present, and the vendor has released fixes in 11.4.9, 12.6.1 and 13.1.0 plus a drop-in workaround IIFE for older versions.
Cross-site scripting in Highcharts JS affects the 10.x branch before 11.4.9, 12.x before 12.6.1, and 13.x through 13.0.2, where an attacker who controls chart configuration can place event-handler keys such as onmouseover under breadcrumbs.style; Highcharts applies those keys as SVG attributes on the breadcrumb button, so the attacker's script runs in the origin of the page hosting the chart. Only charts rendered in non-styled mode apply the option, and the handler fires only after a victim drills down or traverses into a hierarchical-series level so the breadcrumbs render and then hovers over or activates the button. Vendor fixes are released in 11.4.9, 12.6.1 and 13.1.0; there is no CISA KEV entry and no public exploit identified at time of analysis, and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N against a vendor CVSS 4.0 base score of 8.4.
Server-side request forgery in WSO2 API Manager and related WSO2 products lets a remote attacker direct the server to arbitrary internal or external network locations and to filesystem resources reachable from the WSO2 host. The vendor CVSS vector requires low-level privileges (PR:L), while the advisory text claims an unauthenticated actor can exploit the flaw, so the authentication barrier is unresolved and should be confirmed with WSO2. No public exploit identified at time of analysis, no CISA KEV entry is present in the supplied data, and the issue is prioritized for handling this week.
Coder deployments that run workspace agents on Google Compute Engine with GCP instance-identity authentication accept replayed GCE identity tokens because the POST /api/v2/workspaceagents/google-instance-identity endpoint never validated the token's audience claim, allowing an attacker holding an unexpired format=full token minted for a different relying party to exchange it for that workspace agent's session token. The resulting agent token stays valid until the workspace's next build, well past the identity token's roughly one-hour lifetime. Affected releases are those before 2.29.21 and the 2.30.0-2.34.11, 2.35.0-2.35.8, 2.36.0-2.36.6 and 2.37.0-2.37.3 ranges, fixed in 2.38.0 and the listed backports; the flaw is unauthenticated per the supplied vector (PR:N) but conditional, since the attacker must already possess a genuine, unexpired token from a VM backing an agent on the workspace's latest build, and no public exploit was identified at time of analysis. The vendor advisory credits independent reports from a customer security team and an external researcher.
russh's SSH agent server signs with keys loaded under the confirm constraint without ever invoking the application's approval hook, so any process able to reach the agent socket - another local process running as the same user, or the remote host when the agent is forwarded with ssh -A - can authenticate or sign data as the user while the key stays loaded. The regression spans russh 0.50.0-beta.12 through 0.64.1 and only affects applications that override Agent::confirm with a real approval or policy check; the default always-true confirm and checks implemented in Agent::confirm_request remain effective, and the private key itself is never exposed. The vendor advisory ships a reproducible test PoC demonstrating the bypass (a unit test, not working exploit code); the issue is not listed in CISA KEV and active exploitation is not confirmed.
Cross-tenant IDOR and missing function-level authorization in YosemiteCrew allow any registered platform user - down to a self-registrable patient or companion-app account - to modify or delete another organization's FHIR service catalogue and PMS task-library/template definitions, with service records additionally readable with no authentication at all. The exposed routes (PATCH and DELETE on /fhir/v1/service/:id, PUT on /v1/task/pms/library/:libraryId, and the PMS template create, update and delete routes) carry only authorizeCognito, while sibling create routes already enforce withOrgPermissions() and requirePermission(...), and the service layer resolves records by global ID without an organisationId filter. Vendor-released patch: none identified at time of analysis - the issue is confirmed at main/dev commit bc1a1824b1a7eba2bc61176cdb61d9a2a11bce57 with no fix queued, and no public exploit code was identified at time of analysis.
Improper authentication in Dell PowerProtect Data Domain allows a remote attacker who already holds low-privileged credentials to bypass protection mechanisms, with high impact on confidentiality and integrity and limited impact on availability (CVSS 3.1 score 8.3, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20. No public exploit code or confirmed active exploitation is identified in the available data, and the flaw is tracked as a this-week priority rather than an emergency; the prerequisite is an existing low-privileged foothold on the appliance rather than unauthenticated access.
XML External Entity (XXE) injection in the SAF-T import feature of the TACTiS NoviGest Desktop App allows an authenticated local user to read local files that are accessible to the application process by submitting a crafted SAF-T XML file. Only users who can reach and use the import function are affected (PR:L, AV:L per the CVSS:4.0 base vector, scored 8.3), and disclosure of sensitive system files specifically depends on the application running with elevated privileges. No public exploit code or confirmed active exploitation is associated with this CVE at time of analysis; INCIBE published the advisory and the issue is prioritized as remediation work for this week rather than an emergency.
Integer overflow in libexpat through 2.9.0's storeAtts() can crash applications or corrupt heap memory when they parse attacker-supplied XML whose single start tag carries more than 2^30 attributes, and the assessed impact is high availability with no confidentiality or integrity effect. The assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H: no authentication or user interaction is required, but exploitation is gated by the need to deliver and parse a multi-gigabyte document, so front-end size or quota limits may prevent it. No public exploit was identified at time of analysis, and patch references exist upstream in libexpat PR #1450 and related commits.
A denial-of-service NULL pointer dereference (CWE-476) in libexpat through 2.9.0 lets remote, unauthenticated attackers crash applications that parse XML with external-entity subparsing enabled, by controlling how input is split across XML_Parse calls so an external-entity subparser's first parse is an empty, non-final buffer. Only availability is affected (VC:N/VI:N/VA:H) and there is no memory corruption, code execution, or data exposure described; the vendor's own patch (PR #1444, commit 7b0d50e4) plus a VulnCheck advisory make the mechanism well-established rather than speculative. No public exploit code and no CISA KEV entry were identified at time of analysis, though exploitation has real preconditions: the application must use XML_ExternalEntityParserCreate via an external-entity-ref handler and the attacker must influence stream chunking.
Memory exhaustion in LibreSSL's ocspcheck command-line utility (versions through 4.4.0) lets an attacker who controls the OCSP responder named in a certificate's AIA extension, or who can intercept plaintext HTTP OCSP traffic, deny certificate status checks by streaming unbounded response headers or body data. The victim must actually run ocspcheck against the hostile or intercepted responder, so this is a conditional, position-dependent flaw rather than something triggerable against arbitrary Internet hosts, and the impact is availability-only with no confidentiality or integrity effect. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis; the vendor has published upstream fixes, and the mixed signals (High headline severity versus a required on-path/responder-control precondition) point to moderate, conditional risk.
Stale authentication state in GraphQL Tools' legacy WebSocket executor lets a later caller inherit a previous caller's downstream identity: the closure-scoped executorConnectionParams object retains per-request extensions.connectionParams after cleanupWebsocket tears down the socket, and the retained keys are replayed in a subsequent connection_init payload. Only applications that reuse a single buildWSLegacyExecutor instance across different authorization contexts are exposed - most notably gateway, schema-stitching, or GraphQL Mesh deployments that pass per-user Authorization or tenant values through extensions.connectionParams; an anonymous or lower-privileged request that omits the sensitive key can then have its downstream subscription executed under the earlier user's token, though the credential itself is never disclosed. Applications that build a fresh executor per request, including the in-repository UrlLoader wrapper, are not affected; exploitation is remote and unauthenticated from the library's perspective but gated by the shared-executor architecture, and no public exploit code was identified at time of analysis.
Quadratic CPU consumption in the npm package decode-uri-component 0.5.0 and earlier lets unauthenticated remote attackers stall the Node.js event loop by supplying malformed percent-encoded input that contains many distinct encoded runs plus a single sequence the native decoder rejects, forcing a fallback path that runs one full-string regular-expression replacement per distinct run. A payload of roughly 224 KB blocks the process for about 20 seconds, but Node's default 16 KB header limit throttles URL-derived input to roughly 40 ms per request, so full impact requires an application that decodes request bodies, such as form bodies parsed with query-string.parse(). The flaw is fixed in 0.5.1, which replaces the replacement loop with a single-pass in-place decode; a public proof-of-concept snippet accompanies the vendor advisory, and it is not verified as working exploit code. Exploitation status: no confirmed active exploitation (not in CISA KEV).
Integrity verification bypass in MONAI before 1.6.1 lets an attacker who can tamper with a download path - via man-in-the-middle or control of a registry/CDN/release channel such as NGC, GitHub releases, or MONAI hosting - substitute bundles, datasets, or model archives because check_hash() silently returns True when hash_val is None and defaults to MD5 when a hash is supplied. The flaw affects default download functions (_download_from_github, _download_from_monaihosting, _download_from_ngc, MedNIST/Decathlon datasets, MMAR/auto3dseg templates), all of which pass hash_val=None, so no integrity check occurs. Direct impact is malicious file delivery (integrity); code execution depends on downstream bundle handling tracked separately, and exploitation requires the attacker to occupy a network or registry position. A public PoC demonstration exists; it demonstrates the silent bypass and is not verified as end-to-end exploit code. No confirmed active exploitation (CISA KEV) is reported.
Denial of service in Labstack Echo's Proxy middleware (v4.15.0 through v4.16.0 and v5.0.0 through v5.4.0) lets unauthenticated remote clients tie up server resources by disconnecting from a WebSocket proxy route while the upstream keeps its side of the connection open, leaving the handler, copy goroutines and network connections retained instead of released. Repeated connections accumulate these leaked resources until the service is degraded or unavailable; only availability is affected, with no confidentiality or integrity impact claimed. Exploitation is conditional rather than trivial - it requires a reachable raw/WebSocket proxy route, an upstream that holds the connection open (a rejected upgrade response delivered over HTTP keep-alive is one such trigger), and permissive or absent connection deadlines. No public exploit code identified at time of analysis; vendor patches are available in 4.16.1 and 5.4.1.
Unbounded gzip expansion in Echo v4's opt-in Decompress middleware (versions 4.0.0 through 4.16.0) allows a small compressed request to decode into a very large body, consuming excessive memory or CPU when a downstream handler reads or binds it; repeated or concurrent requests can exhaust server resources and cause denial of service. The middleware is not enabled by default, so exposure is limited to applications that explicitly wire it onto a reachable route and pass the decoded body to a handler, and exposure is further reduced where an effective body limit is applied after decompression. No public exploit code has been identified at time of analysis; the vendor fixed the issue in Echo v4.16.1 by adding a configurable maximum decompressed size.
Echo v4's opt-in BodyDump middleware can be driven to exhaust process memory by unauthenticated remote clients that send large request bodies or cause large responses on routes where the middleware is enabled, resulting in denial of service. Versions 4.0.0 through 4.16.0 are affected; BodyDump is not enabled by default, so default Echo deployments are not exposed. The flaw is fixed in 4.16.1, and no public exploit has been identified at time of analysis.
MailWatch for MailScanner 1.2.26 and earlier applies the per-role tenant filter when listing or reading quarantined mail but does not apply it on the quarantine action endpoint, so any authenticated tenant account - the low-privilege U/user, D/domain-admin and H/host roles, not just A/admin - can act on other users' and domains' quarantined messages. By supplying an arbitrary, enumerable message id to mailscanner/quarantine_action.php, an attacker can force-deliver held mail (including malware or phishing that the quarantine was containing) to the recipient's inbox or permanently delete it, giving high integrity and availability impact with no confidentiality impact (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The advisory documents a reporter reproduction against v1.2.26; there is no CISA KEV entry and no confirmed active exploitation, and the practical limiting factor is that the attacker must already hold a valid low-privilege account on the instance, making a malicious or compromised internal/tenant user the realistic threat.
Unauthenticated remote code execution is possible in Red Hat JBoss Enterprise Application Platform 7 and 8 when the server runs in -secmgr mode with the openjdk-orb CORBA/IIOP listener exposed on TCP 3528. An attacker who can reach that listener can send a CDR-encoded object whose attacker-supplied codebase URL is honoured by JDKBridge during unmarshalling, causing the server JVM to load and instantiate arbitrary classes from a remote location before EJB security interceptors are evaluated. Exploitation is gated on non-default conditions - the -secmgr startup flag and a network-reachable IIOP/CDR listener - and the sources do not confirm active exploitation (CISA KEV) or verified working exploit code; the decision label is 'this_week', indicating a credible high-severity threat that is not a drop-everything emergency.
CVE-2026-109411 is tracked through the Ubuntu vendor channel, which indicates the affected code is a package distributed by Ubuntu, but the supplied record carries no description, CVSS vector, CWE classification, or reference links, so the specific package, the vulnerable versions, and the resulting impact are all unverified. No public exploit code or proof-of-concept reference is present in the supplied data, and risk cannot be meaningfully quantified from the supplied data. The only prioritization signal available is the vuln.today decision label 'this_month', which places it below immediate-action items.
Mattermost server 11.7.x through 11.7.10, 11.8.x through 11.8.5, and 11.9.x through 11.9.1 can be induced to replace an installed plugin and execute code on the server when an authenticated user with posting rights in a channel visible to a system administrator crafts a post containing a forged mention reminder and the administrator clicks it. The Agents plugin's mention reminder component fails to validate the target post ID, so the administrator's browser sends an unintended API request; CVSS 3.1 is 8.0 with PR:L, UI:R, AC:H, and S:C, meaning exploitation needs an authenticated attacker plus a privileged click and is not a default remote path. No public exploit was identified at time of analysis, and the issue is not in CISA KEV; the supplied priority label is this_week.
A stack-based buffer overflow in the prh_sdp_service_search_decode function of the Alpine iLX-F511 in-vehicle head unit (version 7.0.000 per EUVD) allows network-adjacent attackers to execute arbitrary code as root. Exploitation requires Bluetooth radio proximity and that the attacker first pair a malicious Bluetooth device with the target, which depends on user interaction to accept the pairing; after pairing, crafted SDP service-search data is copied into a fixed-size stack buffer without length validation. No public exploit or confirmed active exploitation was identified at time of analysis, and the priority signals (this_week) reflect a genuine high-severity flaw with meaningful prerequisites rather than an emergency.
A stack-based buffer overflow in the vCard parser of the Alpine iLX-F511 in-dash multimedia receiver (build 7.0.0000) lets an attacker within Bluetooth range execute arbitrary code as root on the head unit. The attacker must operate a malicious Bluetooth device and convince the user to connect the iLX-F511 to it, after which a crafted vCard containing contact data is parsed without adequate length validation and overruns a fixed-length stack buffer; no authentication is required on the attacker's side. Reach is proximity-bound and dependent on that deliberate user-initiated pairing, and no public exploit code was identified at time of analysis, so this is a patch-priority issue rather than a mass-exploitation emergency. The flaw was reported through the Zero Day Initiative as ZDI-CAN-29017 / ZDI-26-821.
Out-of-bounds kernel memory writes in Zephyr's GPIO syscall verification layer let a user-mode thread escape the userspace sandbox: in builds with CONFIG_USERSPACE=y, z_vrfy_gpio_pin_configure(), z_vrfy_gpio_pin_get_config() and z_vrfy_gpio_pin_interrupt_configure() checked only the device object and passed the caller-supplied gpio_pin_t straight to the driver, where the sole pin guard was an __ASSERT compiled out of production builds. All releases from 2.2.0 through 4.4.2 are affected, and the attacker must already hold a legitimate grant to a GPIO device object - the grant meant to confine it to that controller's pins. Downstream impact is driver- and SoC-dependent (STM32 EXTI callback array overflow, ITE it8xxx2 out-of-bounds MMIO base pointer, gpio_emul flags[] overflow), yielding supervisor-mode memory corruption, possible arbitrary code execution, or a crash; a public proof-of-concept accompanies the GHSA advisory, though it is not verified as general-purpose exploit code, and there is no KEV or confirmed active-exploitation signal.
Code injection in Ultralytics' parse_model function lets an attacker execute arbitrary Python code with the privileges of the current user when the victim opens a malicious model file or otherwise loads attacker-controlled input. The root cause is CWE-94: a user-supplied string is not validated before being used to execute Python code; the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, so no privileges are required but user interaction is mandatory. There is no network-facing, zero-click path in the described flaw, and no public exploit has been identified at time of analysis; the vuln.today decision label is 'this_week'.
Deserialization of untrusted data in Ultralytics' load_dataset_cache_file function allows arbitrary code execution in the context of the current user when a victim loads an attacker-supplied dataset whose cache data is processed by that routine. The flaw is rated 7.8 (CVSS:3.0/3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because exploitation is local rather than network-reachable and depends entirely on convincing the user to open or load the malicious file - a social-engineering prerequisite that meaningfully narrows realistic exposure despite the high confidentiality, integrity and availability impact. Reported to the vendor by Trend Micro Zero Day Initiative (ZDI-CAN-30124 / ZDI-26-816); no public exploit code has been identified at time of analysis and no CISA KEV entry exists, and the source data provides no EPSS score.
Code injection in Ultralytics' parse_model function lets an attacker execute arbitrary Python in the context of the current user when a victim loads a crafted model definition or configuration, such as by visiting a malicious page or opening a malicious file (ZDI-CAN-30123). The CVSS vector is local (AV:L) and requires user interaction (UI:R) with no privileges required (PR:N), giving a 7.8 High severity score with high confidentiality, integrity and availability impact, though code execution is bounded by the victim's own privileges (S:U). No public exploit code has been identified at time of analysis and the flaw has not been reported as actively exploited; the vendor advisory ZDI-26-815 is the primary reference.
OS command injection in Ultralytics' torch_safe_load function allows an attacker who supplies a crafted model file to execute arbitrary code with the privileges of the user who loads it. Reachability is limited: the assessed vector is local (AV:L) with mandatory user interaction (UI:R), so an attacker cannot trigger the flaw across the network and must instead convince the victim to open a malicious model/weights file or visit a page that causes such a load - CVSS 3.0 base score 7.8 (High) is scored PR:N but the practical gate is the victim's action. No public exploit code identified at time of analysis, and realistic exposure is confined to environments that ingest third-party or community weights rather than only trusted, internally produced models.
Code injection in the Ultralytics Python package's check_det_dataset function lets an attacker execute arbitrary Python in the context of the user running the library. Per the supplied CVSS vector the weakness is locally reachable and unauthenticated (AV:L/PR:N), but it is gated by user interaction (UI:R) - the victim must open a crafted file or visit a malicious page that feeds an unvalidated string into the vulnerable call - and the resulting code runs only with the current user's privileges (S:U). No CISA KEV entry or confirmed public exploit code was identified at time of analysis; the only public reference is the ZDI advisory ZDI-26-813, and the CPE string wildcards all Ultralytics versions as potentially affected.
Deserialization of untrusted data in Ultralytics' torch_load function allows code to run in the context of the current user when a victim loads a malicious PyTorch model or weights file, or visits a page that causes such a file to be deserialized. The assessed vector is CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8): no authentication is required (PR:N), but the Local vector and mandatory user interaction mean there is no unauthenticated network-reachable trigger, and code execution does not cross a privilege boundary. No CISA KEV entry and no public exploit were identified at time of analysis; priority is scheduled remediation this week rather than emergency response.
Local privilege escalation in the Alpine iLX-F511 in-vehicle media receiver lets code already running as a low-privileged user reach root through an exposed dangerous method in the Fiv service, with high impact to confidentiality, integrity and availability. The attack is local-only and requires a prior foothold on the device (CVSS PR:L), so it is a post-compromise escalation step rather than a remotely reachable entry point; no user interaction is needed once that prerequisite is met. EUVD lists version 7.0.000 as affected, a public ZDI advisory (ZDI-26-820, ZDI-CAN-29095) documents the finding, and no vendor-released patch was identified at time of analysis, with no public exploit identified at time of analysis and no CISA KEV listing.
KaringX ClashMi through 1.0.32.1801 ships an HttpUtils helper that disables TLS certificate validation by default, so any HTTPS response the app fetches - including its auto-update manifest - is accepted regardless of the certificate presented. An attacker who controls or intercepts the proxy node the user routes through can return a forged update manifest that omits the sha256 integrity field and point the updater at a malicious installer, yielding code execution with the privileges of the app when the update runs. Exploitation is unauthenticated (PR:N) but conditional: the adversary must sit in the update request's HTTPS path and the auto-update flow must actually execute, and no public exploit code or CISA KEV entry was identified at time of analysis; the VulnCheck-sourced report is prioritized for remediation this week.
Server-side request forgery in KServe lets any principal that holds namespace-scoped create or update rights on InferenceService custom resources point the model-serving controller at an attacker-chosen destination: the crafted `storageUri` is fetched by the `storage-initializer` init container, which issues arbitrary outbound HTTP/HTTPS requests from inside the cluster. The result is information disclosure rather than data corruption - successful abuse can expose the node's cloud IAM role credentials through instance-metadata endpoints or reach internal-only cluster services that the tenant namespace could not otherwise touch. Exploitation is access-gated, requiring the attacker to already hold those InferenceService RBAC permissions (CVSS PR:L, scope-changed, confidentiality-only), and no public exploit was identified at time of analysis; the vendor rates it this_week, not an emergency.
Grafana OSS and Grafana Enterprise can be tricked into sending server-side requests to an attacker-controlled endpoint that carry the Azure Monitor data source's Azure access token, handing that credential to the attacker. The flaw is only reachable in deployments that have an Azure Monitor data source configured, and only by an authenticated account holding query access to that data source (PR:L) - anonymous users cannot reach it, and instances without an Azure Monitor data source are not exposed. Because the stolen token grants access outside Grafana itself, the vector carries a scope change with high confidentiality impact and no integrity or availability impact; no public exploit was identified at time of analysis and the issue is not in CISA KEV, placing it in a this-week remediation cadence rather than an emergency.
Grafana OSS and Grafana Enterprise 12.4.x through 13.2.x allow an authenticated user who can edit contact points but is denied permission to edit their protected fields to change those protected settings - including a contact point's destination URL - by switching an integration to a legacy schema version, potentially exposing stored credentials and redirecting alert notifications. The underlying issue is an incorrect authorization check (CWE-863) rated 7.7 with a scope change; no public exploit code and no CISA KEV entry are identified at time of analysis, and the vuln.today decision label is 'this_week', making this a credible operational priority rather than an emergency.
Authorization bypass in mongodb/laravel-mongodb can let an authenticated user with basic privileges read, change, or delete documents that an application intended to withhold when it relies on an absence-of-related-record relationship check. The flaw is a type-handling error in relationship query building (CWE-843) that silently compiles that check with an identifier of the wrong data type; exploitation is conditional on the application using this authorization pattern and on a triggering identifier type, matching the assessed CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the vendor references release 5.12.0.
OS command injection in Dell PowerProtect Data Domain Virtual Edition allows an attacker who already holds administrative privileges on the appliance to execute arbitrary operating system commands over the network. The flaw affects the Feature Release train from 7.7.1.0 through 8.8 as well as the LTS2024 (7.13.1.0-7.13.1.80), LTS2025 (8.3.1.0-8.3.1.40) and LTS2026 (8.6.1.0-8.6.1.20) builds, and carries a CVSSv3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation is gated by the PR:H prerequisite, so realistic abuse is confined to malicious administrators or attackers who have already obtained admin credentials; no public exploit has been identified at time of analysis, the issue is not in CISA KEV, and the assessed priority is 'this_week' rather than an emergency.
OutOfMemoryError denial of service in jackson-dataformat-protobuf allows a remote unauthenticated attacker to crash a protobuf-consuming service with a 33-byte payload when a length-prefixed string or bytes field has an attacker-controlled varint length near Integer.MAX_VALUE. Affected packages are com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf through 2.22.3 (including 2.18.11 and 2.21.7) and tools.jackson.dataformat:jackson-dataformat-protobuf through 3.2.3 (including 3.1.7); default ProtobufMapper configurations are vulnerable, and the evidence confirms that maxStringLength, maxDocumentLength, maxNestingDepth, and -Xmx tuning do not prevent the allocation failure. This is a genuine but bounded priority: impact is availability-only, and exploitation requires that the service deserialize attacker-reachable protobuf using a schema with an attacker-influenced string or bytes field; the advisory includes a 33-byte reproduction confirmed against shipping 2.21.7 and 3.1.7 jars, while no CISA KEV listing is indicated.
Arbitrary file upload in the Affiliate Toolkit WordPress plugin through 3.9.2 lets authenticated contributor-level users place files that may be executable onto the server, which can lead to remote code execution, though the path is only reachable when the plugin's 'import product image' option is enabled. The upload_image routine in ATKPTools.php validates uploads with a weak Content-Type prefix check and derives the file extension from the attacker-controlled URL path with no dangerous-extension stripping, so a crafted image URL attached to a product post can carry an executable extension past the check. No CISA KEV entry or public exploit code is associated with this CVE at time of analysis, and the required authenticated foothold, non-default setting and high attack complexity temper the practical priority.
MongoDB Database Tools builds prior to 100.20.0 (specifically 100.19.0, compiled with Golang 1.26.8) will accept TLS server certificates chaining to the eMudhra CA, which Go's crypto/x509 denylist only began rejecting in Golang 1.27.3. An attacker holding a man-in-the-middle position on the network path and a usable eMudhra-issued certificate for the targeted hostname could therefore intercept DB Tools connections to a MongoDB server and read or alter traffic; the victim must actively initiate the connection. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the flaw is resolved in DB Tools 100.20.0.
Authenticated SQL injection in OpenCATS prior to 0.10.0 lets any logged-in user who can reach the home Calls DataGrid (home:CallsDataGrid) or activity DataGrid (activity:ActivityDataGrid) rewrite the date-filter SQL and read data beyond their intended scope, including user accounts, candidate records, contacts, company records, job orders and activity history. The flaw sits in the request-controlled period, startDate and endDate parameters, which are concatenated into SQL date comparisons in modules/home/dataGrids.php and modules/activity/dataGrids.php without validation or escaping; a valid OpenCATS login is required and unauthenticated exploitation is not established. The confidentiality impact dominates (the data exposure is the practical harm), and no public exploit code was identified at time of analysis; the vendor-released patch is OpenCATS 0.10.0.