Monthly
Local privilege escalation in Pi-hole 6.0.0 through 6.4.2 lets an attacker who already has code execution as the unprivileged pihole user become root by overwriting the /etc/pihole/logrotate configuration file. Because pihole-FTL-prestart.sh chowns that file to root:root and the daily flush cron then parses it as root via logrotate, a malicious firstaction shell directive runs as uid 0. This is a CWE-282 improper ownership issue with total technical impact; SSVC lists exploitation as proof-of-concept and it is fixed in 6.4.3, with no CISA KEV listing and a low EPSS of 0.22%.
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to access unauthorized content within the private data network. With a CVSS score of 8.8 (High), an attacker with low-level authenticated access can potentially access, modify, or delete sensitive data they should not have permissions to view. No public proof-of-concept or active exploitation (KEV listing) has been reported at this time.
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Snipe-IT's consumables checkout API endpoint writes the checkout target user's identifier into the `created_by` audit column rather than the authenticated caller's identifier, poisoning the audit trail. Authenticated attackers holding only the `consumables.checkout` permission can silently attribute their checkout actions to any target user in the `consumables_users` pivot table, effectively laundering their operational footprint from the system's records. The fix is available in version 8.7.0; no public exploit or active exploitation has been identified at time of analysis.
OpenStack Cyborg before 16.0.1 fails to enforce project ownership in the Accelerator Request (ARQ) API, allowing any authenticated non-admin user to delete, modify, or access ARQs bound to other projects' instances across tenant boundaries. The vulnerability stems from a combination of unpopulated project_id columns, missing database-layer filtering, and self-referential authorization checks, enabling cross-tenant denial of service and potential information disclosure. EPSS risk is moderate (6.3 CVSS), and the vulnerability requires valid authentication but no special privileges or interaction, making it exploitable by any tenant user in multi-tenant OpenStack deployments.
Improper ownership management in Moxa Secure Router allows low-privileged authenticated users to access exported configuration files containing hashed administrative passwords, enabling credential disclosure. The vulnerability is confined to scenarios where configuration files have been exported and requires valid user credentials to exploit; no impact to system integrity or availability has been identified.
Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier fails to set the correct context when resolving Vault credentials, letting an authenticated Jenkins user who holds Item/Configure permission access and potentially capture Vault secrets that belong to a different, more privileged scope. The path is network-reachable with low privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3), and it only applies where the plugin is installed and configured to resolve Vault credentials - anonymous and read-only users cannot reach it. No public exploit identified at time of analysis, and EPSS is only 0.23% (13th percentile), so this is a moderate-to-low priority information-disclosure issue rather than an emergency.
In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership. Rated high severity (CVSS 7.5). No vendor patch available.
IBM OpenPages with Watson 8.3 and 9.0 could allow an authenticated user to obtain sensitive information that should only be available to privileged users.
A privilege escalation vulnerability (CVSS 2.9) that allows a bypass of build isolation. Remediation should follow standard vulnerability management procedures.
Local privilege escalation in Pi-hole 6.0.0 through 6.4.2 lets an attacker who already has code execution as the unprivileged pihole user become root by overwriting the /etc/pihole/logrotate configuration file. Because pihole-FTL-prestart.sh chowns that file to root:root and the daily flush cron then parses it as root via logrotate, a malicious firstaction shell directive runs as uid 0. This is a CWE-282 improper ownership issue with total technical impact; SSVC lists exploitation as proof-of-concept and it is fixed in 6.4.3, with no CISA KEV listing and a low EPSS of 0.22%.
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to access unauthorized content within the private data network. With a CVSS score of 8.8 (High), an attacker with low-level authenticated access can potentially access, modify, or delete sensitive data they should not have permissions to view. No public proof-of-concept or active exploitation (KEV listing) has been reported at this time.
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Snipe-IT's consumables checkout API endpoint writes the checkout target user's identifier into the `created_by` audit column rather than the authenticated caller's identifier, poisoning the audit trail. Authenticated attackers holding only the `consumables.checkout` permission can silently attribute their checkout actions to any target user in the `consumables_users` pivot table, effectively laundering their operational footprint from the system's records. The fix is available in version 8.7.0; no public exploit or active exploitation has been identified at time of analysis.
OpenStack Cyborg before 16.0.1 fails to enforce project ownership in the Accelerator Request (ARQ) API, allowing any authenticated non-admin user to delete, modify, or access ARQs bound to other projects' instances across tenant boundaries. The vulnerability stems from a combination of unpopulated project_id columns, missing database-layer filtering, and self-referential authorization checks, enabling cross-tenant denial of service and potential information disclosure. EPSS risk is moderate (6.3 CVSS), and the vulnerability requires valid authentication but no special privileges or interaction, making it exploitable by any tenant user in multi-tenant OpenStack deployments.
Improper ownership management in Moxa Secure Router allows low-privileged authenticated users to access exported configuration files containing hashed administrative passwords, enabling credential disclosure. The vulnerability is confined to scenarios where configuration files have been exported and requires valid user credentials to exploit; no impact to system integrity or availability has been identified.
Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier fails to set the correct context when resolving Vault credentials, letting an authenticated Jenkins user who holds Item/Configure permission access and potentially capture Vault secrets that belong to a different, more privileged scope. The path is network-reachable with low privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3), and it only applies where the plugin is installed and configured to resolve Vault credentials - anonymous and read-only users cannot reach it. No public exploit identified at time of analysis, and EPSS is only 0.23% (13th percentile), so this is a moderate-to-low priority information-disclosure issue rather than an emergency.
In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership. Rated high severity (CVSS 7.5). No vendor patch available.
IBM OpenPages with Watson 8.3 and 9.0 could allow an authenticated user to obtain sensitive information that should only be available to privileged users.
A privilege escalation vulnerability (CVSS 2.9) that allows a bypass of build isolation. Remediation should follow standard vulnerability management procedures.