Monthly
Unauthenticated ONVIF service endpoints in Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 fail to enforce authentication on management requests, letting any attacker who can route to the device invoke sensitive device operations directly. No credentials, user interaction, or non-default configuration are required - the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is a remotely reachable, unauthenticated flaw in the default request-handling path, and the independent assessment rates it a genuine high-priority issue with high confidentiality, integrity, and availability impact. Exploitation is limited only by network exposure (same LAN, VPN, or an internet-exposed/port-forwarded device); no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), though the CISA ICS advisory ICSA-26-272-05 documents the issue.
Taskview Community before 1.56.0 ships its OAuth 2.0 Dynamic Client Registration endpoint enabled by default and reachable without authentication, letting any remote unauthenticated attacker register a rogue OAuth client and obtain a working client_id and client_secret. The attacker then distributes a crafted authorization link that redirects to an attacker-controlled URI, and once the victim approves the consent screen the captured authorization code is exchanged for an access token granting full API access to that victim's account data. No public exploit identified at time of analysis, but with a CVSS 4.0 score of 8.5 and high confidentiality and integrity impact this is a high-priority account-takeover flaw; because exploitation depends on victim interaction it is delivered through phishing-style social engineering rather than a silent compromise.
Session token forgery in SigNoz v0.8.0 through v0.142.x allows unauthenticated attackers to impersonate any user, including administrators, when the default JWT tokenizer provider runs without a configured signing secret. The application defaults the JWT HMAC key to an empty string and fails to reject this in Config.Validate(), so tokens are both signed and verified with an empty key; an attacker who knows a target user ID can forge valid access and refresh tokens, and the refresh token can be rotated at /api/v2/sessions/rotate and cannot be revoked. No public exploit identified at time of analysis; deployments that explicitly set a secret or use the opaque provider are not affected, and v0.143.0 eliminates the exposure.
Insecure-by-default OpenSSL options in Apache Tomcat Native (versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8) silently weaken the TLS layer used by the APR/OpenSSL connector, enabling insecure client-initiated renegotiation, disabling the Extended Master Secret extension, ignoring unexpected EOF (truncation), and permitting key exchanges without (EC)DHE forward secrecy. The vendor scored this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), but our independent assessment rates it substantially lower - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - because meaningful abuse requires an on-path/man-in-the-middle attacker who can actively position themselves between client and server, and because the four options are only applied when the deployment has not explicitly overridden them. Only Tomcat instances configured with the Apache Tomcat Native (APR) TLS connector at an affected version are exposed; JSSE/NIO-based connectors are unaffected, and no public exploit code or CISA KEV entry was identified at time of analysis. Vendors/users should upgrade to Tomcat Native 2.0.16 or 1.3.9.
Xiongmai XM530-based IP cameras running firmware HMT.CM2005-v220608.1837 and earlier ship the embedded Happytime RTSP server inside the Sofia IPC daemon with authentication disabled by default, so anyone who can reach the RTSP port can pull the live H.264 video and G.711 audio streams. The media leaves the device in cleartext over RTP/UDP, meaning the feed is also recoverable by an on-path observer on the same network segment. There is no CISA KEV entry and EPSS is very low at 0.22% (13th percentile), so this is currently an exposure-driven rather than campaign-driven risk, though exploitation requires no credentials, no user interaction, and only a standard RTSP client.
Remote code execution in KGUARD DVR devices running 2016-era firmware allows any unauthenticated attacker with network reachability to run arbitrary system commands, because a command-execution service is bound to all interfaces (0.0.0.0) with no authentication, leading to full device takeover. The flaw is actively exploited in the wild by the Mirai_ptea (Rimasuta), Mirai_aurora, and rapperbot botnets for malware propagation and DDoS, per Netlab 360 reporting. Firmware released after 2017 mitigates the issue by restricting the service to the localhost interface.
Path traversal and pickle deserialization protections in NLTK before 3.10.0 are effectively disabled by default - pathsec.py sets ENFORCE=False, causing all security validation to emit warnings rather than raise blocking exceptions. Any application using NLTK to process untrusted file paths or serialized data is exposed unless operators have explicitly overridden this default. No public exploit has been identified at time of analysis, but the attack surface is significant wherever NLTK handles attacker-controlled inputs, particularly given that Python pickle deserialization can enable arbitrary code execution.
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Exposure of a default-credentialed PostgreSQL database in the VPS.org one-click Supabase template allows remote attackers to connect directly to the database on 0.0.0.0:5432 using the well-known default password 'postgres', gaining full read/write access. The flaw stems from insecure default initialization combined with Docker's iptables rules overriding host UFW firewall policy, so operators who believe UFW protects the port are silently exposed. No public exploit has been identified at time of analysis, and EPSS is low (0.14%, 4th percentile), but SSVC rates the technical impact as total and exploitation as automatable.
Arbitrary file read and remote code execution in Ruby on Rails Active Storage's libvips-based variant processor allows unauthenticated remote attackers to upload a crafted file and invoke unsafe libvips 'unfuzzed' operations, disclosing arbitrary server files including process environment variables that typically contain secret_key_base and external service credentials. Applications using the libvips variant processor (the default since load_defaults 7.0) that accept image uploads from untrusted users across activestorage versions below 7.2.3.2, 8.0.5.1, and 8.1.3.1 are affected. No public exploit code has been released at disclosure time (July 30, 2026), but independent researchers from Ethiack and GMO Flatt Security assess that AI-assisted POC development is feasible within hours, making immediate patching critical.
Unauthenticated ONVIF service endpoints in Anjvision YSSD-RTMP-H5 cameras running firmware 3.3.2.4 fail to enforce authentication on management requests, letting any attacker who can route to the device invoke sensitive device operations directly. No credentials, user interaction, or non-default configuration are required - the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is a remotely reachable, unauthenticated flaw in the default request-handling path, and the independent assessment rates it a genuine high-priority issue with high confidentiality, integrity, and availability impact. Exploitation is limited only by network exposure (same LAN, VPN, or an internet-exposed/port-forwarded device); no public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV), though the CISA ICS advisory ICSA-26-272-05 documents the issue.
Taskview Community before 1.56.0 ships its OAuth 2.0 Dynamic Client Registration endpoint enabled by default and reachable without authentication, letting any remote unauthenticated attacker register a rogue OAuth client and obtain a working client_id and client_secret. The attacker then distributes a crafted authorization link that redirects to an attacker-controlled URI, and once the victim approves the consent screen the captured authorization code is exchanged for an access token granting full API access to that victim's account data. No public exploit identified at time of analysis, but with a CVSS 4.0 score of 8.5 and high confidentiality and integrity impact this is a high-priority account-takeover flaw; because exploitation depends on victim interaction it is delivered through phishing-style social engineering rather than a silent compromise.
Session token forgery in SigNoz v0.8.0 through v0.142.x allows unauthenticated attackers to impersonate any user, including administrators, when the default JWT tokenizer provider runs without a configured signing secret. The application defaults the JWT HMAC key to an empty string and fails to reject this in Config.Validate(), so tokens are both signed and verified with an empty key; an attacker who knows a target user ID can forge valid access and refresh tokens, and the refresh token can be rotated at /api/v2/sessions/rotate and cannot be revoked. No public exploit identified at time of analysis; deployments that explicitly set a secret or use the opaque provider are not affected, and v0.143.0 eliminates the exposure.
Insecure-by-default OpenSSL options in Apache Tomcat Native (versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8) silently weaken the TLS layer used by the APR/OpenSSL connector, enabling insecure client-initiated renegotiation, disabling the Extended Master Secret extension, ignoring unexpected EOF (truncation), and permitting key exchanges without (EC)DHE forward secrecy. The vendor scored this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), but our independent assessment rates it substantially lower - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - because meaningful abuse requires an on-path/man-in-the-middle attacker who can actively position themselves between client and server, and because the four options are only applied when the deployment has not explicitly overridden them. Only Tomcat instances configured with the Apache Tomcat Native (APR) TLS connector at an affected version are exposed; JSSE/NIO-based connectors are unaffected, and no public exploit code or CISA KEV entry was identified at time of analysis. Vendors/users should upgrade to Tomcat Native 2.0.16 or 1.3.9.
Xiongmai XM530-based IP cameras running firmware HMT.CM2005-v220608.1837 and earlier ship the embedded Happytime RTSP server inside the Sofia IPC daemon with authentication disabled by default, so anyone who can reach the RTSP port can pull the live H.264 video and G.711 audio streams. The media leaves the device in cleartext over RTP/UDP, meaning the feed is also recoverable by an on-path observer on the same network segment. There is no CISA KEV entry and EPSS is very low at 0.22% (13th percentile), so this is currently an exposure-driven rather than campaign-driven risk, though exploitation requires no credentials, no user interaction, and only a standard RTSP client.
Remote code execution in KGUARD DVR devices running 2016-era firmware allows any unauthenticated attacker with network reachability to run arbitrary system commands, because a command-execution service is bound to all interfaces (0.0.0.0) with no authentication, leading to full device takeover. The flaw is actively exploited in the wild by the Mirai_ptea (Rimasuta), Mirai_aurora, and rapperbot botnets for malware propagation and DDoS, per Netlab 360 reporting. Firmware released after 2017 mitigates the issue by restricting the service to the localhost interface.
Path traversal and pickle deserialization protections in NLTK before 3.10.0 are effectively disabled by default - pathsec.py sets ENFORCE=False, causing all security validation to emit warnings rather than raise blocking exceptions. Any application using NLTK to process untrusted file paths or serialized data is exposed unless operators have explicitly overridden this default. No public exploit has been identified at time of analysis, but the attack surface is significant wherever NLTK handles attacker-controlled inputs, particularly given that Python pickle deserialization can enable arbitrary code execution.
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Exposure of a default-credentialed PostgreSQL database in the VPS.org one-click Supabase template allows remote attackers to connect directly to the database on 0.0.0.0:5432 using the well-known default password 'postgres', gaining full read/write access. The flaw stems from insecure default initialization combined with Docker's iptables rules overriding host UFW firewall policy, so operators who believe UFW protects the port are silently exposed. No public exploit has been identified at time of analysis, and EPSS is low (0.14%, 4th percentile), but SSVC rates the technical impact as total and exploitation as automatable.
Arbitrary file read and remote code execution in Ruby on Rails Active Storage's libvips-based variant processor allows unauthenticated remote attackers to upload a crafted file and invoke unsafe libvips 'unfuzzed' operations, disclosing arbitrary server files including process environment variables that typically contain secret_key_base and external service credentials. Applications using the libvips variant processor (the default since load_defaults 7.0) that accept image uploads from untrusted users across activestorage versions below 7.2.3.2, 8.0.5.1, and 8.1.3.1 are affected. No public exploit code has been released at disclosure time (July 30, 2026), but independent researchers from Ethiack and GMO Flatt Security assess that AI-assisted POC development is feasible within hours, making immediate patching critical.