Monthly
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Full-disk-encryption bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 stems from a default TPM PCR sealing policy that ignores the system boot state, letting an attacker with physical access unseal the TPM through an unintended execution path or by relocating the drive/TPM to another hardware platform and recover the BitLocker keys. The flaw was documented in the Black Hat USA 2026 research 'The Cost of Obscurity' by Burch; there is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is low at 0.18% (8th percentile), consistent with a physical-access rather than mass-exploitable weakness.
Nozomi Networks Arc for Windows installs the Npcap packet capture driver with its access restriction option left at the insecure default, making the driver accessible to all local users rather than administrators only. Any non-privileged local user on an affected host can leverage this misconfiguration to capture network traffic traversing the host's interfaces - exposing data from both the local system and peer hosts on the same network segment - and to inject arbitrary raw packets onto that segment. No public exploit has been identified and the CVSS 4.0 score of 4.8 reflects the local-access prerequisite; however, the dual capability of traffic capture and packet injection is operationally significant in the OT/ICS environments where Arc is primarily deployed, where industrial protocols are often unencrypted.
Sharp Corporation's Network Scanner Tool and Network Scanner Tool Lite expose unauthenticated, unlimited file upload endpoints by default, enabling two distinct attack outcomes against any PC running the software in its initial configuration. An unauthenticated network attacker can flood the host with uploaded files to exhaust disk or system resources, causing a denial-of-service condition; separately, a threat actor can stage malicious executables that a local PC user may be socially engineered into running, enabling downstream attacks against other systems. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the default-insecure nature and zero authentication requirement lower the barrier to exploitation significantly.
Unauthenticated network access to address book editing and Document Filing features is possible on Sharp and Toshiba Tec multifunction printers (MFPs) sold outside Japan, because these devices ship from the factory with user authentication disabled. The root cause is CWE-1188 (Insecure Default Initialization of Resource) - the authentication control exists but is not activated in the initial configuration, meaning any network-reachable attacker can access sensitive stored data and modify contact directories without credentials. No public exploit code and no CISA KEV listing exist at time of analysis, but the CVSS vector confirms network-level unauthenticated access with no interaction required.
Exposure of a default-credentialed PostgreSQL database in the VPS.org one-click Supabase template allows remote attackers to connect directly to the database on 0.0.0.0:5432 using the well-known default password 'postgres', gaining full read/write access. The flaw stems from insecure default initialization combined with Docker's iptables rules overriding host UFW firewall policy, so operators who believe UFW protects the port are silently exposed. No public exploit has been identified at time of analysis, and EPSS is low (0.14%, 4th percentile), but SSVC rates the technical impact as total and exploitation as automatable.
Arbitrary file read and remote code execution in Ruby on Rails Active Storage's libvips-based variant processor allows unauthenticated remote attackers to upload a crafted file and invoke unsafe libvips 'unfuzzed' operations, disclosing arbitrary server files including process environment variables that typically contain secret_key_base and external service credentials. Applications using the libvips variant processor (the default since load_defaults 7.0) that accept image uploads from untrusted users across activestorage versions below 7.2.3.2, 8.0.5.1, and 8.1.3.1 are affected. No public exploit code has been released at disclosure time (July 30, 2026), but independent researchers from Ethiack and GMO Flatt Security assess that AI-assisted POC development is feasible within hours, making immediate patching critical.
Information disclosure in alibabacloud-rds-openapi-mcp-server due to default exposure of MCP tools allows remote unauthenticated attackers to invoke tools via network access to a listener on all interfaces. No public exploit or active exploitation has been identified at the time of analysis, but the default configuration makes exploitation trivial for network-accessible instances.
Policy bypass in NLnet Labs Unbound 1.6.0 through 1.25.1 causes DNS queries for default-protected zones - including RFC 1918 reverse zones, AS112 zones, .onion, and .localhost - to escape to public recursive resolvers instead of being answered locally. The root cause is that the unbound-control commands view_local_data and view_local_datas, when issued against a named view that was initially configured with no local data, create a bare local zones tree that omits the expected default-protected zone entries. Clients mapped to that view subsequently receive answers from the public internet for names that are supposed to be handled locally, silently subverting operator-defined DNS policy. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Unauthenticated media upload in the Membership Pro subscription extension for Joomla (all versions 1.0 through 4.6.1) lets remote attackers push arbitrary media assets to the server without any account or login, due to an insecure default configuration. The flaw carries a CVSS 9.1 rating and CISA's SSVC framework marks it as automatable with total technical impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It is fixed in version 4.6.2.
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Full-disk-encryption bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 stems from a default TPM PCR sealing policy that ignores the system boot state, letting an attacker with physical access unseal the TPM through an unintended execution path or by relocating the drive/TPM to another hardware platform and recover the BitLocker keys. The flaw was documented in the Black Hat USA 2026 research 'The Cost of Obscurity' by Burch; there is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is low at 0.18% (8th percentile), consistent with a physical-access rather than mass-exploitable weakness.
Nozomi Networks Arc for Windows installs the Npcap packet capture driver with its access restriction option left at the insecure default, making the driver accessible to all local users rather than administrators only. Any non-privileged local user on an affected host can leverage this misconfiguration to capture network traffic traversing the host's interfaces - exposing data from both the local system and peer hosts on the same network segment - and to inject arbitrary raw packets onto that segment. No public exploit has been identified and the CVSS 4.0 score of 4.8 reflects the local-access prerequisite; however, the dual capability of traffic capture and packet injection is operationally significant in the OT/ICS environments where Arc is primarily deployed, where industrial protocols are often unencrypted.
Sharp Corporation's Network Scanner Tool and Network Scanner Tool Lite expose unauthenticated, unlimited file upload endpoints by default, enabling two distinct attack outcomes against any PC running the software in its initial configuration. An unauthenticated network attacker can flood the host with uploaded files to exhaust disk or system resources, causing a denial-of-service condition; separately, a threat actor can stage malicious executables that a local PC user may be socially engineered into running, enabling downstream attacks against other systems. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the default-insecure nature and zero authentication requirement lower the barrier to exploitation significantly.
Unauthenticated network access to address book editing and Document Filing features is possible on Sharp and Toshiba Tec multifunction printers (MFPs) sold outside Japan, because these devices ship from the factory with user authentication disabled. The root cause is CWE-1188 (Insecure Default Initialization of Resource) - the authentication control exists but is not activated in the initial configuration, meaning any network-reachable attacker can access sensitive stored data and modify contact directories without credentials. No public exploit code and no CISA KEV listing exist at time of analysis, but the CVSS vector confirms network-level unauthenticated access with no interaction required.
Exposure of a default-credentialed PostgreSQL database in the VPS.org one-click Supabase template allows remote attackers to connect directly to the database on 0.0.0.0:5432 using the well-known default password 'postgres', gaining full read/write access. The flaw stems from insecure default initialization combined with Docker's iptables rules overriding host UFW firewall policy, so operators who believe UFW protects the port are silently exposed. No public exploit has been identified at time of analysis, and EPSS is low (0.14%, 4th percentile), but SSVC rates the technical impact as total and exploitation as automatable.
Arbitrary file read and remote code execution in Ruby on Rails Active Storage's libvips-based variant processor allows unauthenticated remote attackers to upload a crafted file and invoke unsafe libvips 'unfuzzed' operations, disclosing arbitrary server files including process environment variables that typically contain secret_key_base and external service credentials. Applications using the libvips variant processor (the default since load_defaults 7.0) that accept image uploads from untrusted users across activestorage versions below 7.2.3.2, 8.0.5.1, and 8.1.3.1 are affected. No public exploit code has been released at disclosure time (July 30, 2026), but independent researchers from Ethiack and GMO Flatt Security assess that AI-assisted POC development is feasible within hours, making immediate patching critical.
Information disclosure in alibabacloud-rds-openapi-mcp-server due to default exposure of MCP tools allows remote unauthenticated attackers to invoke tools via network access to a listener on all interfaces. No public exploit or active exploitation has been identified at the time of analysis, but the default configuration makes exploitation trivial for network-accessible instances.
Policy bypass in NLnet Labs Unbound 1.6.0 through 1.25.1 causes DNS queries for default-protected zones - including RFC 1918 reverse zones, AS112 zones, .onion, and .localhost - to escape to public recursive resolvers instead of being answered locally. The root cause is that the unbound-control commands view_local_data and view_local_datas, when issued against a named view that was initially configured with no local data, create a bare local zones tree that omits the expected default-protected zone entries. Clients mapped to that view subsequently receive answers from the public internet for names that are supposed to be handled locally, silently subverting operator-defined DNS policy. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Unauthenticated media upload in the Membership Pro subscription extension for Joomla (all versions 1.0 through 4.6.1) lets remote attackers push arbitrary media assets to the server without any account or login, due to an insecure default configuration. The flaw carries a CVSS 9.1 rating and CISA's SSVC framework marks it as automatable with total technical impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It is fixed in version 4.6.2.