2026-11-04
Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets a remote, low-privileged authenticated user trigger memory corruption by supplying an overlong addEffect argument to the setMacFilterRules function in /cgi-bin/cstecgi.cgi. Successful exploitation can produce high confidentiality, integrity, and availability impact, but the device's web management interface is typically LAN-bound, so Internet exploitation generally requires exposed remote management or an internal foothold. A public PoC reference exists; it is not verified as working exploit code, and no active exploitation is confirmed.
A stack-based buffer overflow in the Multi-SSID Configuration handler of the TOTOLINK A950RG wireless router (firmware 4.1.2cu.5268_B20221104) lets an attacker who is logged in to the web management interface corrupt memory by sending an oversized wepkey2 or wepkey3 value to the setWiFiMultipleConfig/delWiFiMultipleConfig endpoints in /cgi-bin/cstecgi.cgi, which can lead to code execution or a crash. The CVSS 4.0 score of 8.6 reflects high confidentiality, integrity and availability impact with no user interaction, but exploitation requires authenticated access (PR:L in both the CVSS 4.0 vector and the assessed CVSS 3.1 vector), so the attacker must already hold valid low-privilege credentials and be able to reach the router's HTTP management interface - typically LAN-side rather than WAN-exposed in default deployments. A public PoC reference exists (a gist linked from the VulDB entry); it is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Stack-based buffer overflow in the TOTOLINK A950RG Basic Wireless Configuration Handler (firmware 4.1.2cu.5268_B20221104) allows remote attackers with low-privilege authentication to corrupt memory by submitting an overlong 'wepkey' value to /cgi-bin/cstecgi.cgi, with high confidentiality, integrity, and availability impact assessed. Exploitation requires network reachability to the router's web management interface and authenticated access sufficient to reach the handler; no user interaction is needed. A public PoC reference exists but is not verified as working exploit code, no CISA KEV listing is indicated, and the issue is assessed as this_week priority rather than an emergency.
A stack-based buffer overflow in the Easy Setup Wizard handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets remote attackers corrupt memory by sending a manipulated functionType argument to setAppEasyWizardConfig in /cgi-bin/cstecgi.cgi, with high impact on confidentiality, integrity and availability. The supplied CVSS vector carries PR:L, so the attacker must hold valid low-privilege credentials or an authenticated session against the device's web management interface, and the interface must be network-reachable (LAN, or WAN where exposed). A public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry indicates active exploitation; priority is assessed as this_week rather than emergency tier.
Authenticated directory traversal in Quest Foglight for Databases lets a low-privileged user bypass the intended extraction directory in the unzipFile method and write files to arbitrary locations, ultimately yielding code execution in the SYSTEM context. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable and needs no user interaction, but a valid account is mandatory - anonymous attackers cannot trigger it. Reported through Trend Micro ZDI as ZDI-CAN-29901 / ZDI-26-860, it is not listed in CISA KEV and no public exploit code or proof-of-concept was identified at time of analysis; the priority signal places it in the this_week remediation window rather than an emergency.
Authenticated remote attackers can execute arbitrary code as SYSTEM on installations of Quest Foglight for Databases by invoking the loadEvolveLicense script with a crafted, unvalidated path used in a file operation (CWE-22 path traversal, ZDI-CAN-29232). The CVSS vector (AV:N/AC:L/PR:L/UI:N with C:H/I:H/A:H) shows a low-privileged account is sufficient and no user interaction is needed, so the only meaningful barrier is obtaining a valid session; once authenticated, the path to SYSTEM-level code execution is low-complexity. There is no confirmed active exploitation (not in CISA KEV), no verified working exploit code is referenced in the available data, and the advisory reference is the Zero Day Initiative disclosure ZDI-26-856; exact affected and fixed version ranges are not stated in the available sources.
Remote code execution in Quest Foglight for Databases requires an authenticated session: a low-privileged user who can supply a crafted path to the loadManageServerLicense script can traverse directories and run code as SYSTEM. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is a credible, above-average priority issue rather than an inflated high-CVSS score. No public exploit was identified at time of analysis, and CISA KEV status is not indicated; the priority label is this_week.
Authenticated remote code execution in Quest Foglight for Databases lets an attacker with valid account access supply a crafted path to the installLicense script, traverse directories, and execute arbitrary code in the SYSTEM context. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) and requires authentication but no user interaction; no public exploit identified at time of analysis. It is tracked as ZDI-CAN-29215 / ZDI-26-855.
Quest Foglight for Databases has an incorrect authorization flaw in its runScript function that lets an authenticated low-privileged attacker execute arbitrary code as SYSTEM over the network without user interaction. The issue is rated CVSS 8.8 (CWE-863) and is prioritized for remediation this week; the supplied data contains no CISA KEV entry and no public exploit identified at time of analysis.
Authenticated directory traversal in Quest Foglight for Databases lets a low-privileged account pass a crafted path into the extractAndCreateUploadInfoList method and write files outside the intended upload location, which can be leveraged to execute arbitrary code as SYSTEM. The flaw is network-reachable with no user interaction required (CVSS 8.8, PR:L), so practical exposure is gated by possession of valid low-privilege credentials and is highest where such accounts are broadly provisioned. No public exploit code and no CISA KEV entry were identified in the available data at time of analysis.
Quest Foglight for Databases contains a path traversal flaw in the paFnUploadFileAndCreateInfo script that lets remote attackers who hold a valid, low-privileged account upload files to arbitrary locations and ultimately execute code as SYSTEM. Affected are installations of the Foglight for Databases management interface; exploitation requires network reachability plus authenticated access (CVSS PR:L), and no user interaction is needed. No public exploit code is identified at time of analysis, the issue has not been reported as actively exploited in the wild, and it is rated a high-priority 'this_week' remediation item rather than an emergency.
Information disclosure in Quest Foglight for Databases lets unauthenticated remote attackers reach the getSource method and submit crafted XML that triggers server-side external entity resolution, exposing data available to the application and enabling arbitrary server-side requests. The flaw is rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N) and requires network reachability to the affected getSource interface; no public exploit code is identified in the supplied intelligence, and the priority label is this_week.
Server-side request forgery in MLflow's get-artifacts function lets unauthenticated remote attackers induce the server to access attacker-supplied URIs and disclose sensitive information from the server's context; the CVSS 3.x base score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). The flaw is tracked as CWE-918 and ZDI-CAN-28192/ZDI-26-844, with a vuln.today decision label of this_week. No CISA KEV confirmation was provided, and no public exploit identified at time of analysis.
An out-of-bounds write in libwebsockets' MQTT PUBACK handling lets unauthenticated remote attackers write past the end of an allocated buffer and potentially execute code in the context of the affected process (ZDI-CAN-31039, CWE-787). The flaw is reachable only where libwebsockets is built with the MQTT role enabled and acting as an MQTT client that connects to a broker the attacker controls or can MITM, so a default or non-MQTT deployment is not exposed; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1 High), with AC:H reflecting conditions beyond the attacker's direct control that the available sources do not describe. No public exploit code was identified at time of analysis and the CVE is not listed as confirmed actively exploited (CISA KEV); the priority label is this_week, driven by the High severity rather than by known exploitation.
Double free in Pixar Animation Studios' OpenUSD crate file parser (pxr/usd/sdf/crateFile.cpp) can lead to arbitrary code execution in the context of the current process when an application linking the library opens a maliciously crafted USDC or USDZ file. The CVSS 3.0 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting that the attacker needs no credentials but must convince a victim to load attacker-controlled scene or asset content - there is no autonomous network trigger, and concrete delivery vectors vary with the embedding application. Reported by Trend Micro ZDI as ZDI-CAN-30428 / ZDI-26-791; an upstream fix commit exists in the OpenUSD repository, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Quest Foglight for Databases lets an attacker who already has low-privileged code execution on the same host obtain SYSTEM privileges by abusing incorrect folder permissions created by the product installer. The issue is scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires local access plus existing low-privileged code execution; it is not remotely reachable and needs no user interaction. No public exploit code was identified at time of analysis.
Local privilege escalation in Quest Foglight for Databases lets an attacker who already holds low-privileged code execution on the host escalate to SYSTEM by abusing a hard-coded cryptographic key in the EncryptionUtil symmetricDecrypt routine. The attack is local-only and requires an existing authenticated foothold (CVSS PR:L), and no public exploit code or CISA KEV entry was identified at time of analysis. With a CVSS base score of 7.8 and high confidentiality, integrity, and availability impact, the flaw is best treated as a post-compromise escalation path on Foglight hosts rather than an internet-facing emergency.
MLflow's SHAP explainer loading path (load_explainer) deserializes untrusted model content, allowing an attacker who supplies a malicious explainer file to execute arbitrary code with the privileges of the user who loads it (CVSS 7.8, CWE-502, ZDI-CAN-30301). The assessed vector is local (AV:L) with user interaction required (UI:R) - the target must open a malicious file or visit a malicious page - so exposure is confined to environments where users load SHAP explainer models from untrusted or unverified sources; no privileges are needed on the target (PR:N) and scope is unchanged, meaning code runs only as that user. No CISA KEV entry and no public exploit code were identified at time of analysis, and the vulnerability carries a 'this_week' priority label rather than an emergency designation.
Code execution in MLflow's PickleEvaluationArtifact handling occurs when a victim loads an attacker-controlled pickle file that is deserialized without proper validation (CWE-502). The CVSS 3.0 base score is 7.8, but the assessed vector is local (AV:L) with required user interaction (UI:R) and no scope change (S:U), so this is not remotely exploitable against a running MLflow server and code runs only in the victim process's context. No CISA KEV entry or public exploit was identified at time of analysis, and vuln.today prioritizes remediation as this_week.
Server-side template injection in the renderTemplateString method of Quest Foglight for Databases lets an authenticated, high-privilege user pass a crafted string into the template engine and have it evaluated as template code, ultimately executing arbitrary commands in the context of SYSTEM. The flaw is rated CVSS 7.2 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-1336) and is bounded by the privileged-authentication prerequisite: there is no unauthenticated or low-privilege path described, and no victim interaction is needed. No confirmed active exploitation (CISA KEV) or public exploit code is identified in the available data, and the vuln.today priority label places it in the this_week remediation bucket rather than an emergency one.
Information disclosure in Quest Foglight for Databases can occur when a crafted XML document containing an external entity is processed by the AbstractParser class, causing the parser to resolve an attacker-chosen URI and embed the retrieved content into the XML document. The CVSS vector indicates network reachability with no authentication and no user interaction, although confidentiality impact is rated Low, suggesting constrained rather than full file disclosure. No CISA KEV entry is present, and no public exploit identified at time of analysis; the available data provides only the ZDI advisory ZDI-26-862, and overall this is a genuine but mid-tier priority rather than an emergency.