Monthly
Cross-request abort in SGLang through 0.5.22 lets unauthenticated remote API clients terminate other users' in-flight generation requests, producing a denial of service against multi-tenant or internet-facing inference servers. An attacker submits a streaming /generate request using a deliberately short, client-controlled rid (for example a single hex character) and then disconnects, at which point the server's prefix-matching abort logic cancels every concurrent request whose identifier begins with that character. The 8.2 CVSS 4.0 score is driven entirely by high availability impact with no confidentiality or integrity effect, and practical impact requires other tenants' requests to be in flight at the same moment; no public exploit code has been identified at time of analysis.
Authentication bypass in SSSD's OIDC/IdP provider allows an authenticated IdP user whose subject identifier is a strict lexical prefix of a target user's identifier to impersonate that target user on SSSD-protected Linux systems. The root cause is `eval_access_token_buf()` passing the attacker-controlled identifier's length to `strncmp()`, reducing an identity equality check to a prefix test. All Red Hat Enterprise Linux releases (6-10) and OpenShift Container Platform 4 are affected when SSSD is configured to use an OIDC-based identity provider; no public exploit has been identified at time of analysis.
Information disclosure in Rack web server interface (versions <2.2.23, <3.1.21, <3.2.6) allows unauthenticated remote attackers to access sensitive files due to flawed prefix matching in Rack::Static. The vulnerability enables access to unintended files sharing configured URL prefixes (e.g., '/css' matching '/css-backup.sql'), exposing configuration files, database backups, or environment variables. CVSS 7.5 (High) with network vector and no complexity. No public exploit identified at time of analysis.
OpenWrt versions prior to 24.10.6 allow local attackers with limited privileges to inject a malicious PATH environment variable into hotplug scripts due to improper filtering in the hotplug_call function, enabling execution of arbitrary binaries with elevated privileges. The vulnerability stems from a strcmp/strncmp logic error that fails to properly exclude the PATH variable when executing scripts in /etc/hotplug.d, resulting in local privilege escalation. No patch is currently available.
Privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an authenticated low-privileged user on the adjacent management network to bypass authorization controls in the account management interface and assign administrative roles to other accounts. Exploitation requires specific conditions and high attack complexity (AC:H), but successful attacks can yield high integrity and availability impact. No public exploit identified at time of analysis; vendor advisory and fixed versions are available.
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches ship in versions 1.13.1 and 1.14.1.
Denial of service in Dell OpenManage Server Administrator (OMSA) managed node versions prior to 11.1.0.3 allows a low-privileged local user on an affected server to crash or disrupt the OMSA agent by supplying input that triggers a flawed partial string comparison. The issue is scored CVSS 5.8 (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H), meaning the attacker must already hold a valid low-privilege foothold on the host, high attack complexity applies because the malformed input must be crafted to specifically exercise the comparison flaw, and the realistic impact ceiling is denial of service rather than host compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Dell has released a fix in OMSA 11.1.0.3; this is a moderate, locally-scoped issue that does not warrant emergency prioritization.
Base-path prefix bypass in Astro prior to 7.2.4 allows unauthenticated remote attackers to reach protected server-side routes by exploiting a missing path-segment boundary check in the framework's base-stripping logic. When a non-root base (e.g., '/app') is configured, a request to '/appX/admin' passes the router's prefix check and resolves to the internal '/admin' route while middleware still observes '/appX/admin' in context.url.pathname, causing pathname-based authorization rules to silently fail. Version 7.2.4 patches the flaw across all four affected subsystems; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Tampering via partial string comparison in the Windows HTTP Protocol Stack (http.sys) exposes a broad range of Windows client and server editions to integrity compromise by unauthenticated adjacent-network attackers. Affected platforms span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, with Microsoft tagging the issue as an authentication bypass rooted in CWE-187. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines.
Partial string comparison in BettaFish's InsightEngine deduplication logic (versions up to 1.2.1) allows remote unauthenticated attackers to manipulate search-result deduplication by crafting inputs that exploit the flawed comparison in `_deduplicate_results` within `InsightEngine/agent.py`. The integrity impact is limited - attackers can cause duplicate or otherwise manipulated entries to persist in search output - but the attack requires no authentication and no user interaction, and a public proof-of-concept exploit exists. No active exploitation has been confirmed by CISA KEV; a fix pull request (PR #689) has been submitted but not yet merged.
Cross-request abort in SGLang through 0.5.22 lets unauthenticated remote API clients terminate other users' in-flight generation requests, producing a denial of service against multi-tenant or internet-facing inference servers. An attacker submits a streaming /generate request using a deliberately short, client-controlled rid (for example a single hex character) and then disconnects, at which point the server's prefix-matching abort logic cancels every concurrent request whose identifier begins with that character. The 8.2 CVSS 4.0 score is driven entirely by high availability impact with no confidentiality or integrity effect, and practical impact requires other tenants' requests to be in flight at the same moment; no public exploit code has been identified at time of analysis.
Authentication bypass in SSSD's OIDC/IdP provider allows an authenticated IdP user whose subject identifier is a strict lexical prefix of a target user's identifier to impersonate that target user on SSSD-protected Linux systems. The root cause is `eval_access_token_buf()` passing the attacker-controlled identifier's length to `strncmp()`, reducing an identity equality check to a prefix test. All Red Hat Enterprise Linux releases (6-10) and OpenShift Container Platform 4 are affected when SSSD is configured to use an OIDC-based identity provider; no public exploit has been identified at time of analysis.
Information disclosure in Rack web server interface (versions <2.2.23, <3.1.21, <3.2.6) allows unauthenticated remote attackers to access sensitive files due to flawed prefix matching in Rack::Static. The vulnerability enables access to unintended files sharing configured URL prefixes (e.g., '/css' matching '/css-backup.sql'), exposing configuration files, database backups, or environment variables. CVSS 7.5 (High) with network vector and no complexity. No public exploit identified at time of analysis.
OpenWrt versions prior to 24.10.6 allow local attackers with limited privileges to inject a malicious PATH environment variable into hotplug scripts due to improper filtering in the hotplug_call function, enabling execution of arbitrary binaries with elevated privileges. The vulnerability stems from a strcmp/strncmp logic error that fails to properly exclude the PATH variable when executing scripts in /etc/hotplug.d, resulting in local privilege escalation. No patch is currently available.
Privilege escalation in Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1) allows an authenticated low-privileged user on the adjacent management network to bypass authorization controls in the account management interface and assign administrative roles to other accounts. Exploitation requires specific conditions and high attack complexity (AC:H), but successful attacks can yield high integrity and availability impact. No public exploit identified at time of analysis; vendor advisory and fixed versions are available.
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches ship in versions 1.13.1 and 1.14.1.
Denial of service in Dell OpenManage Server Administrator (OMSA) managed node versions prior to 11.1.0.3 allows a low-privileged local user on an affected server to crash or disrupt the OMSA agent by supplying input that triggers a flawed partial string comparison. The issue is scored CVSS 5.8 (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H), meaning the attacker must already hold a valid low-privilege foothold on the host, high attack complexity applies because the malformed input must be crafted to specifically exercise the comparison flaw, and the realistic impact ceiling is denial of service rather than host compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Dell has released a fix in OMSA 11.1.0.3; this is a moderate, locally-scoped issue that does not warrant emergency prioritization.
Base-path prefix bypass in Astro prior to 7.2.4 allows unauthenticated remote attackers to reach protected server-side routes by exploiting a missing path-segment boundary check in the framework's base-stripping logic. When a non-root base (e.g., '/app') is configured, a request to '/appX/admin' passes the router's prefix check and resolves to the internal '/admin' route while middleware still observes '/appX/admin' in context.url.pathname, causing pathname-based authorization rules to silently fail. Version 7.2.4 patches the flaw across all four affected subsystems; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Tampering via partial string comparison in the Windows HTTP Protocol Stack (http.sys) exposes a broad range of Windows client and server editions to integrity compromise by unauthenticated adjacent-network attackers. Affected platforms span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, with Microsoft tagging the issue as an authentication bypass rooted in CWE-187. No public exploit has been identified at time of analysis, and Microsoft has released patched builds across all affected product lines.
Partial string comparison in BettaFish's InsightEngine deduplication logic (versions up to 1.2.1) allows remote unauthenticated attackers to manipulate search-result deduplication by crafting inputs that exploit the flawed comparison in `_deduplicate_results` within `InsightEngine/agent.py`. The integrity impact is limited - attackers can cause duplicate or otherwise manipulated entries to persist in search output - but the attack requires no authentication and no user interaction, and a public proof-of-concept exploit exists. No active exploitation has been confirmed by CISA KEV; a fix pull request (PR #689) has been submitted but not yet merged.