Monthly
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated remote attacker can externally influence system configuration settings (CWE-15), enabling disclosure of sensitive information and - per the CVSS vector - potential integrity and availability compromise as well. The changed scope (S:C) in the CVSS vector indicates the vulnerability can propagate impact beyond the directly affected component, consistent with how mirror configuration alterations can affect the paired IBM i high-availability node. A vendor-released patch is available via IBM Support; no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
FreePBX Framework's restore functionality allows an authenticated user with backup-restore privileges to inject the hidden AUTHTYPE=none configuration setting via a crafted backup archive, completely disabling web administration authentication on the affected PBX. Versions prior to 16.0.47 (branch 16) and 17.0.30 (branch 17) are confirmed affected; vendor patches have been released. No public exploit identified at time of analysis, though the fix commit diff publicly reveals the exact attack technique against a widely deployed telephony platform.
Arbitrary command execution in Ouroboros (ouroboros-ai pip package, versions <= 0.42.0) is reachable when a developer runs `ooo` inside a malicious cloned repository, due to an incomplete denylist that left several execution-routing environment variable keys unblocked. The 0.39.0 fix for CVE-2026-47211 introduced `_UNTRUSTED_ENV_DENYLIST` but omitted keys spanning backend config-home roots, MCP bridge config, plugin trust roots, SSRF transport toggles, and capability override paths - all of which are auto-loaded from a project-directory `.env` at import with no review step. A separate code path additionally auto-loaded `./.ouroboros/mcp_servers.yaml` from the current working directory, enabling RCE with no `.env` file at all. No public exploit code has been identified at time of analysis, though the GHSA advisory provides sufficient technical specificity for independent derivation. Vendor-released patch 0.42.1 resolves both attack surfaces.
HCL iControl versions 4.3.0 and 4.4.0 publicly expose internal configuration files due to inadequate web server or application hardening, mapping to CWE-15 (External Control of System or Configuration Setting). The misconfiguration allows attackers to retrieve sensitive configuration data that may contain credentials, internal paths, service endpoints, or other operational details usable for further lateral movement or privilege escalation. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at the time of analysis.
Unauthorized configuration write in Dashy self-hosted dashboard (versions prior to 4.0.8) lets unauthenticated users or non-admin authenticated users overwrite the central config.yaml via the config-saving endpoint when the deployment uses OIDC authentication, bypassing configured permission controls. Successful abuse enables tampering with dashboard configuration and potential service disruption. No public exploit identified at time of analysis; not listed in CISA KEV.
Script injection in SAP CRM WebClient UI is enabled by absent Content Security Policy (CSP) directives for certain restrictive headers, allowing an authenticated low-privileged attacker to inject malicious JavaScript that executes in a victim user's browser session. The CVSS vector (PR:L/UI:R/S:C) confirms this requires both an authenticated attacker and victim interaction, with a cross-scope impact consistent with browser-context script execution. No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis, and impact is bounded to low integrity with no confidentiality or availability consequence.
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authenticated administrators on the local network to manipulate device configuration beyond intended boundaries, classified under CWE-15 (External Control of System or Configuration Setting). The CVSS 4.0 vector (AV:A/PR:H/VI:H) confirms that exploitation is constrained to adjacent network access with high-privilege credentials, yet the integrity impact on the vulnerable system is rated High. No public exploit code exists (SSVC: Exploitation none; CVSS E:U), and NETGEAR has released firmware patches for all affected product lines.
Authenticated remote code execution affects HAX CMS PHP backend versions prior to 26.0.0, where attackers with valid credentials can configure malicious Git filter commands to overwrite files and execute arbitrary code on the server. The flaw carries a CVSS 4.0 score of 9.4 due to full compromise of confidentiality, integrity, and availability with cascading subsequent system impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission to create or modify Route resources to inject controlled directives into the cluster ingress configuration via the spec.path field. No public exploit identified at time of analysis, but the CVSS 8.8 score with scope change (S:C) reflects the ability to break out of the tenant boundary and impact the shared HAProxy router serving the entire cluster.
Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain a denial-of-service vulnerability that allows remote attackers to cause the monitor to reboot by sending a malformed network. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated remote attacker can externally influence system configuration settings (CWE-15), enabling disclosure of sensitive information and - per the CVSS vector - potential integrity and availability compromise as well. The changed scope (S:C) in the CVSS vector indicates the vulnerability can propagate impact beyond the directly affected component, consistent with how mirror configuration alterations can affect the paired IBM i high-availability node. A vendor-released patch is available via IBM Support; no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
FreePBX Framework's restore functionality allows an authenticated user with backup-restore privileges to inject the hidden AUTHTYPE=none configuration setting via a crafted backup archive, completely disabling web administration authentication on the affected PBX. Versions prior to 16.0.47 (branch 16) and 17.0.30 (branch 17) are confirmed affected; vendor patches have been released. No public exploit identified at time of analysis, though the fix commit diff publicly reveals the exact attack technique against a widely deployed telephony platform.
Arbitrary command execution in Ouroboros (ouroboros-ai pip package, versions <= 0.42.0) is reachable when a developer runs `ooo` inside a malicious cloned repository, due to an incomplete denylist that left several execution-routing environment variable keys unblocked. The 0.39.0 fix for CVE-2026-47211 introduced `_UNTRUSTED_ENV_DENYLIST` but omitted keys spanning backend config-home roots, MCP bridge config, plugin trust roots, SSRF transport toggles, and capability override paths - all of which are auto-loaded from a project-directory `.env` at import with no review step. A separate code path additionally auto-loaded `./.ouroboros/mcp_servers.yaml` from the current working directory, enabling RCE with no `.env` file at all. No public exploit code has been identified at time of analysis, though the GHSA advisory provides sufficient technical specificity for independent derivation. Vendor-released patch 0.42.1 resolves both attack surfaces.
HCL iControl versions 4.3.0 and 4.4.0 publicly expose internal configuration files due to inadequate web server or application hardening, mapping to CWE-15 (External Control of System or Configuration Setting). The misconfiguration allows attackers to retrieve sensitive configuration data that may contain credentials, internal paths, service endpoints, or other operational details usable for further lateral movement or privilege escalation. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at the time of analysis.
Unauthorized configuration write in Dashy self-hosted dashboard (versions prior to 4.0.8) lets unauthenticated users or non-admin authenticated users overwrite the central config.yaml via the config-saving endpoint when the deployment uses OIDC authentication, bypassing configured permission controls. Successful abuse enables tampering with dashboard configuration and potential service disruption. No public exploit identified at time of analysis; not listed in CISA KEV.
Script injection in SAP CRM WebClient UI is enabled by absent Content Security Policy (CSP) directives for certain restrictive headers, allowing an authenticated low-privileged attacker to inject malicious JavaScript that executes in a victim user's browser session. The CVSS vector (PR:L/UI:R/S:C) confirms this requires both an authenticated attacker and victim interaction, with a cross-scope impact consistent with browser-context script execution. No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis, and impact is bounded to low integrity with no confidentiality or availability consequence.
System integrity tampering across a broad portfolio of NETGEAR home and small-business networking devices allows authenticated administrators on the local network to manipulate device configuration beyond intended boundaries, classified under CWE-15 (External Control of System or Configuration Setting). The CVSS 4.0 vector (AV:A/PR:H/VI:H) confirms that exploitation is constrained to adjacent network access with high-privilege credentials, yet the integrity impact on the vulnerable system is rated High. No public exploit code exists (SSVC: Exploitation none; CVSS E:U), and NETGEAR has released firmware patches for all affected product lines.
Authenticated remote code execution affects HAX CMS PHP backend versions prior to 26.0.0, where attackers with valid credentials can configure malicious Git filter commands to overwrite files and execute arbitrary code on the server. The flaw carries a CVSS 4.0 score of 9.4 due to full compromise of confidentiality, integrity, and availability with cascading subsequent system impact. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission to create or modify Route resources to inject controlled directives into the cluster ingress configuration via the spec.path field. No public exploit identified at time of analysis, but the CVSS 8.8 score with scope change (S:C) reflects the ability to break out of the tenant boundary and impact the shared HAProxy router serving the entire cluster.
Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain a denial-of-service vulnerability that allows remote attackers to cause the monitor to reboot by sending a malformed network. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.