Monthly
MOVEit Transfer deployments running versions before 2025.1.6 or from 2026.0.0 up to but not including 2026.0.4 are affected by improper handling of Unicode encoding (CWE-176), which can allow a low-privileged authenticated user reaching the network-exposed service to achieve high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a valid MOVEit Transfer account and depends on high-complexity conditions - likely precisely crafted Unicode sequences that defeat normalization or validation logic - so real-world exploitability is constrained despite the full C:H/I:H/A:H impact triad, and no public exploit identified at time of analysis. The affected ranges imply fixed releases at 2025.1.6 and 2026.0.4, and the vendor's September 2026 security bulletin is the authoritative advisory.
Malformed UTF-16 decoding in libexpat through 2.8.4 lets remote attackers hide XML markup from the parser: a lone high surrogate paired with the following code unit is accepted as a valid surrogate pair, so a character such as '<' is consumed as part of the pair and never tokenized. Only applications that parse UTF-16-encoded XML (little- or big-endian) from an untrusted source are affected - the dominant UTF-8 input path is not exploitable - and meaningful integrity impact additionally requires a downstream filter, sanitizer, or validator that trusts the parsed structure and therefore sees different markup than Expat exposes. No public exploit has been identified at time of analysis; an upstream fix is available in the Expat repository (PR #1282, commit ff6e1d7e750bbe245178f51a47a965dc8342861a), reported via VulnCheck.
Denial of service in the Perl module Text::Minify::XS (v0.3.0 up to but excluding v0.7.8) arises because its minify functions mishandle certain malformed UTF-8 byte sequences, corrupting the heap. A remote attacker who can supply crafted text to an application that calls minify (or its alias minify_utf8) can trigger heap corruption and crash the process. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.04%), and the flaw is not in CISA KEV.
Two-factor authentication bypass in SonicWall SMA1000 SSL-VPN allows remote attackers with valid SSLVPN credentials to circumvent TOTP requirements via Unicode encoding manipulation. Affects SMA1000 versions 12.5.0-02283 and 12.4.3-03245 and earlier. Requires high-privilege (PR:H) authenticated access but enables complete authentication bypass (CVSS 7.2). Low EPSS score (0.03%, 10th percentile) indicates minimal observed exploitation likelihood. No public exploit code identified at time of analysis.
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
Improper handling of Unicode encoding in Apache log4net's SmtpPickupDirAppender lets an attacker who can place unencodable content - such as an unpaired UTF-16 surrogate like U+D800 - into a logged message break the appender's file writer, causing the entire buffered batch of logging events to be discarded rather than just the offending event, and leaving a truncated mail file in the pickup directory for the mail service to send. Only applications configured to use SmtpPickupDirAppender (the SMTP pickup-directory appender) with event buffering are affected; versions from 1.2.9 before 3.5.0 are impacted. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - remote and unauthenticated once attacker data reaches a rendered log field - but impact is confined to integrity of log output (suppression/truncation of audit records), with no confidentiality or availability loss; no public exploit code was identified at time of analysis and it is not confirmed actively exploited (not in CISA KEV).
Improper Unicode encoding in the pwhois command-line tool shipped with Net::Whois::Raw before 2.99044 for Perl causes WHOIS lookups for certain internationalized domain names to be sent for the wrong domain, disclosing the queried name to an unrelated registry and returning results for the incorrect domain; the Net::Whois::Raw library modules themselves are not affected. The flaw (CWE-176, CVSS 3.1 5.4, vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) is unauthenticated but requires user interaction - the victim must run pwhois against a unicode label that pwhois does not lowercase (i.e., contains uppercase letters other than ASCII/Cyrillic, or is not in NFC form) - and only the CLI path is impacted. EPSS is low at 0.18% (7th percentile), no public exploit code exists, there is no CISA KEV entry indicating active exploitation, and a vendor patch is available in release 2.99044.
Authorization bypass in the WatchGuard Fireware OS Access Portal reverse proxy lets an authenticated, low-privileged portal user reach back-end web applications they are not entitled to by sending a specially crafted request for a resource they are authorized to access. Exploitation requires valid Access Portal credentials, the SSL clientless portal to be enabled and reachable, and a specific crafted-request condition (CVSS 4.0 AT:P), so this is a genuine but bounded access-control flaw rather than a pre-auth compromise path. Impact is primarily confidentiality: unauthorized read of other portal-published web applications, with limited integrity effects and no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Improper UTF-8 percent-decoding in uri-js through 4.4.1 lets remote, unauthenticated attackers feed crafted percent-encoded URIs that the library converts into ASCII metacharacters such as '/', '\', '.' and CRLF, enabling downstream path traversal or CRLF injection wherever the decoded output is consumed without re-validation. The flaw is remotely triggerable with no authentication or user interaction (CVSS:4.0 base 6.9; independent assessment CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), but real-world harm is constrained by the consuming application: no code execution, no availability impact, and no effect at all if the downstream code re-validates the decoded string. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is currently a latent input-neutralization weakness for applications that treat uri-js output as already-sanitized rather than a live exploitation campaign.
Span attribute length limits can be bypassed in the OpenTelemetry-Go SDK trace package from 1.10.0 up to (but not including) 1.33.0, allowing an attacker who controls content recorded as a span attribute to retain string values far longer than the configured AttributeValueLengthLimit and thereby inflate per-span memory use inside the instrumented process. The root cause is a Unicode handling defect: the truncation helper misclassifies the valid replacement character U+FFFD as invalid UTF-8 and returns the original oversized value, and a fallback sanitization pass also leaves it unchanged. The impact is limited to a weakening of the SDK's built-in denial-of-service guard - there is no code execution, no confidentiality or integrity impact, and no public exploit code identified at time of analysis; the vendor scores it 5.1 (CVSS 4.0, AV:L, PR:N, VA:L) and our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
MOVEit Transfer deployments running versions before 2025.1.6 or from 2026.0.0 up to but not including 2026.0.4 are affected by improper handling of Unicode encoding (CWE-176), which can allow a low-privileged authenticated user reaching the network-exposed service to achieve high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a valid MOVEit Transfer account and depends on high-complexity conditions - likely precisely crafted Unicode sequences that defeat normalization or validation logic - so real-world exploitability is constrained despite the full C:H/I:H/A:H impact triad, and no public exploit identified at time of analysis. The affected ranges imply fixed releases at 2025.1.6 and 2026.0.4, and the vendor's September 2026 security bulletin is the authoritative advisory.
Malformed UTF-16 decoding in libexpat through 2.8.4 lets remote attackers hide XML markup from the parser: a lone high surrogate paired with the following code unit is accepted as a valid surrogate pair, so a character such as '<' is consumed as part of the pair and never tokenized. Only applications that parse UTF-16-encoded XML (little- or big-endian) from an untrusted source are affected - the dominant UTF-8 input path is not exploitable - and meaningful integrity impact additionally requires a downstream filter, sanitizer, or validator that trusts the parsed structure and therefore sees different markup than Expat exposes. No public exploit has been identified at time of analysis; an upstream fix is available in the Expat repository (PR #1282, commit ff6e1d7e750bbe245178f51a47a965dc8342861a), reported via VulnCheck.
Denial of service in the Perl module Text::Minify::XS (v0.3.0 up to but excluding v0.7.8) arises because its minify functions mishandle certain malformed UTF-8 byte sequences, corrupting the heap. A remote attacker who can supply crafted text to an application that calls minify (or its alias minify_utf8) can trigger heap corruption and crash the process. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.04%), and the flaw is not in CISA KEV.
Two-factor authentication bypass in SonicWall SMA1000 SSL-VPN allows remote attackers with valid SSLVPN credentials to circumvent TOTP requirements via Unicode encoding manipulation. Affects SMA1000 versions 12.5.0-02283 and 12.4.3-03245 and earlier. Requires high-privilege (PR:H) authenticated access but enables complete authentication bypass (CVSS 7.2). Low EPSS score (0.03%, 10th percentile) indicates minimal observed exploitation likelihood. No public exploit code identified at time of analysis.
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
Improper handling of Unicode encoding in Apache log4net's SmtpPickupDirAppender lets an attacker who can place unencodable content - such as an unpaired UTF-16 surrogate like U+D800 - into a logged message break the appender's file writer, causing the entire buffered batch of logging events to be discarded rather than just the offending event, and leaving a truncated mail file in the pickup directory for the mail service to send. Only applications configured to use SmtpPickupDirAppender (the SMTP pickup-directory appender) with event buffering are affected; versions from 1.2.9 before 3.5.0 are impacted. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - remote and unauthenticated once attacker data reaches a rendered log field - but impact is confined to integrity of log output (suppression/truncation of audit records), with no confidentiality or availability loss; no public exploit code was identified at time of analysis and it is not confirmed actively exploited (not in CISA KEV).
Improper Unicode encoding in the pwhois command-line tool shipped with Net::Whois::Raw before 2.99044 for Perl causes WHOIS lookups for certain internationalized domain names to be sent for the wrong domain, disclosing the queried name to an unrelated registry and returning results for the incorrect domain; the Net::Whois::Raw library modules themselves are not affected. The flaw (CWE-176, CVSS 3.1 5.4, vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) is unauthenticated but requires user interaction - the victim must run pwhois against a unicode label that pwhois does not lowercase (i.e., contains uppercase letters other than ASCII/Cyrillic, or is not in NFC form) - and only the CLI path is impacted. EPSS is low at 0.18% (7th percentile), no public exploit code exists, there is no CISA KEV entry indicating active exploitation, and a vendor patch is available in release 2.99044.
Authorization bypass in the WatchGuard Fireware OS Access Portal reverse proxy lets an authenticated, low-privileged portal user reach back-end web applications they are not entitled to by sending a specially crafted request for a resource they are authorized to access. Exploitation requires valid Access Portal credentials, the SSL clientless portal to be enabled and reachable, and a specific crafted-request condition (CVSS 4.0 AT:P), so this is a genuine but bounded access-control flaw rather than a pre-auth compromise path. Impact is primarily confidentiality: unauthorized read of other portal-published web applications, with limited integrity effects and no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Improper UTF-8 percent-decoding in uri-js through 4.4.1 lets remote, unauthenticated attackers feed crafted percent-encoded URIs that the library converts into ASCII metacharacters such as '/', '\', '.' and CRLF, enabling downstream path traversal or CRLF injection wherever the decoded output is consumed without re-validation. The flaw is remotely triggerable with no authentication or user interaction (CVSS:4.0 base 6.9; independent assessment CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), but real-world harm is constrained by the consuming application: no code execution, no availability impact, and no effect at all if the downstream code re-validates the decoded string. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is currently a latent input-neutralization weakness for applications that treat uri-js output as already-sanitized rather than a live exploitation campaign.
Span attribute length limits can be bypassed in the OpenTelemetry-Go SDK trace package from 1.10.0 up to (but not including) 1.33.0, allowing an attacker who controls content recorded as a span attribute to retain string values far longer than the configured AttributeValueLengthLimit and thereby inflate per-span memory use inside the instrumented process. The root cause is a Unicode handling defect: the truncation helper misclassifies the valid replacement character U+FFFD as invalid UTF-8 and returns the original oversized value, and a fallback sanitization pass also leaves it unchanged. The impact is limited to a weakening of the SDK's built-in denial-of-service guard - there is no code execution, no confidentiality or integrity impact, and no public exploit code identified at time of analysis; the vendor scores it 5.1 (CVSS 4.0, AV:L, PR:N, VA:L) and our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.