Monthly
An authenticated administrator of an HPE networking product can reach a low-complexity, network-exposed flaw and achieve full confidentiality, integrity and availability impact on the affected component, according to an HPE security bulletin (document HPESBNW05162) scored at CVSS 3.1 base 7.2. The vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms the issue is remotely reachable with no user interaction, but the high-privilege prerequisite (PR:H) means only an attacker who already holds an administrative or otherwise privileged account on the device can exploit it, so the realistic exposure is an insider, a compromised administrative credential, or a post-exploitation step, not anonymous internet attack. No public exploit code or proof-of-concept is referenced in the supplied sources, and the specific affected product, version, feature and protocol are not described in the available data.
Project isolation bypass in Incus lets an authenticated client that is confined to one project copy and read custom storage volumes belonging to any other project on the same server, including volume snapshots and configuration. The flaw affects Incus 7.0.1 (fixed in 7.0.2) and 7.2.0 through 7.4.x (fixed in 7.5.0), and is reachable only through a hand-crafted POST to /1.0/storage-pools/{pool}/volumes/custom that supplies a source volume with an attacker-chosen source.project while omitting source.type - the official Incus client always sets source.type=copy and therefore cannot trigger it. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires legitimate low-privilege credentials holding can_create_storage_volumes in at least one project, so impact is concentrated on multi-project servers where project isolation is the actual security boundary.
Improper access control in Splunk Enterprise 9.4, 10.0, 10.2, and 10.4 allows a low-privileged authenticated user to cross a security boundary and achieve high confidentiality, integrity, and availability impact, making the release a 9.9 severity fix. The flaw was found during Cisco's internal hardening review rather than through external reporting, and the affected ranges are 9.4 before 9.4.16, 10.0 before 10.0.11, 10.2 before 10.2.8, and 10.4 before 10.4.4. No public exploit code has been identified and there is no CISA KEV entry, but vendor patch availability combined with an act_now priority label places upgraded discipline on anyone running an unpatched instance; the trigger is not described in the available sources.
Authenticated Splunk Enterprise users whose roles include the schedule_search capability can use the scheduled search workflow to run risky SPL commands that the platform would normally block, resulting in disclosure or alteration of Splunk data or disruption of Splunk availability. The issue affects Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and is fixed in those releases. The assessed vector requires low privileges (PR:L) and no user interaction, with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis.
Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java Secure Socket Extension) component, rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N). Affected builds are Java SE 8u511 and 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, plus Oracle GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise Edition 21.3.20. Oracle's alert states the flaw is reachable via APIs of the affected component, such as a web service feeding untrusted data into JSSE, and adds a secondary sandbox-escape path for deployments running untrusted code in Java Web Start applications or applets; no public exploit code or active exploitation was identified at time of analysis, but the missing authentication prerequisite and network reachability make this a high-priority patch target rather than a paper finding.
Local access-control bypass in Cisco Unified Communications products allows an authenticated low-privileged user or local session holder to gain high confidentiality, integrity, and availability impact, with scope change beyond the vulnerable component. The CVSS 3.1 score is 8.8, but the vector is AV:L/PR:L, so exploitation requires existing local access and valid low-privilege credentials rather than a remote unauthenticated path; no public exploit or CISA KEV active exploitation is identified. Affected products include Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection, and Cisco hardening releases are available via advisory cisco-sa-voice-hardening-twgbH9e3.
Improper input validation in Node.js DNS resolution functions lets hostname or address strings containing null bytes reach dns.resolve/dns.lookup, which the 26.12.1 security release fixes by adding explicit null-byte validation of resolve inputs. Node.js 22.x through 22.23.3, 24.x through 24.22.0, and 26.x through 26.12.0 are affected, with the vendor patch shipped in Node.js 26.12.1. The assessed vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H) means unauthenticated remote reach is possible but exploitation is conditional on the target application passing attacker-influenced strings into DNS resolution, and the exact trigger mechanism is not described in the available sources; a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV listing.
Cache aliasing in vLLM before 0.31.0 allows authenticated users of a shared deployment to receive another request's cached processed media or reuse first-block KV cache state by supplying colliding EXIF ImageID or cache_salt values. The flaw is only exploitable when image-processing and/or prefix-KV caches are shared across distinct callers or tenants and the attacker can control the relevant cache-key inputs; single-tenant or isolated-cache deployments have no cross-request target. No public exploit identified at time of analysis; the vendor CVSS 4.0 score is 7.1, and the independent assessment rates confidentiality impact high with limited integrity impact.
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve full takeover of the Essbase instance, with scope change allowing significant impact on additional products. The vulnerability carries a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is considered high priority; no public exploit identified at time of analysis, and no CISA KEV confirmation was provided. Exploitation is gated by reachability to the T3/IIOP management protocols and possession of a low-privileged account.
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network access, due to a security flaw in the product's Security component. Successful exploitation can fully compromise confidentiality, integrity, and availability and, because of the scope change, may extend impact to additional connected products. This is a high-priority vulnerability; no public exploit identified at time of analysis, and the CVSS 3.1 base score is 9.9.
An authenticated administrator of an HPE networking product can reach a low-complexity, network-exposed flaw and achieve full confidentiality, integrity and availability impact on the affected component, according to an HPE security bulletin (document HPESBNW05162) scored at CVSS 3.1 base 7.2. The vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms the issue is remotely reachable with no user interaction, but the high-privilege prerequisite (PR:H) means only an attacker who already holds an administrative or otherwise privileged account on the device can exploit it, so the realistic exposure is an insider, a compromised administrative credential, or a post-exploitation step, not anonymous internet attack. No public exploit code or proof-of-concept is referenced in the supplied sources, and the specific affected product, version, feature and protocol are not described in the available data.
Project isolation bypass in Incus lets an authenticated client that is confined to one project copy and read custom storage volumes belonging to any other project on the same server, including volume snapshots and configuration. The flaw affects Incus 7.0.1 (fixed in 7.0.2) and 7.2.0 through 7.4.x (fixed in 7.5.0), and is reachable only through a hand-crafted POST to /1.0/storage-pools/{pool}/volumes/custom that supplies a source volume with an attacker-chosen source.project while omitting source.type - the official Incus client always sets source.type=copy and therefore cannot trigger it. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires legitimate low-privilege credentials holding can_create_storage_volumes in at least one project, so impact is concentrated on multi-project servers where project isolation is the actual security boundary.
Improper access control in Splunk Enterprise 9.4, 10.0, 10.2, and 10.4 allows a low-privileged authenticated user to cross a security boundary and achieve high confidentiality, integrity, and availability impact, making the release a 9.9 severity fix. The flaw was found during Cisco's internal hardening review rather than through external reporting, and the affected ranges are 9.4 before 9.4.16, 10.0 before 10.0.11, 10.2 before 10.2.8, and 10.4 before 10.4.4. No public exploit code has been identified and there is no CISA KEV entry, but vendor patch availability combined with an act_now priority label places upgraded discipline on anyone running an unpatched instance; the trigger is not described in the available sources.
Authenticated Splunk Enterprise users whose roles include the schedule_search capability can use the scheduled search workflow to run risky SPL commands that the platform would normally block, resulting in disclosure or alteration of Splunk data or disruption of Splunk availability. The issue affects Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and is fixed in those releases. The assessed vector requires low privileges (PR:L) and no user interaction, with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis.
Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java Secure Socket Extension) component, rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N). Affected builds are Java SE 8u511 and 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, plus Oracle GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise Edition 21.3.20. Oracle's alert states the flaw is reachable via APIs of the affected component, such as a web service feeding untrusted data into JSSE, and adds a secondary sandbox-escape path for deployments running untrusted code in Java Web Start applications or applets; no public exploit code or active exploitation was identified at time of analysis, but the missing authentication prerequisite and network reachability make this a high-priority patch target rather than a paper finding.
Local access-control bypass in Cisco Unified Communications products allows an authenticated low-privileged user or local session holder to gain high confidentiality, integrity, and availability impact, with scope change beyond the vulnerable component. The CVSS 3.1 score is 8.8, but the vector is AV:L/PR:L, so exploitation requires existing local access and valid low-privilege credentials rather than a remote unauthenticated path; no public exploit or CISA KEV active exploitation is identified. Affected products include Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection, and Cisco hardening releases are available via advisory cisco-sa-voice-hardening-twgbH9e3.
Improper input validation in Node.js DNS resolution functions lets hostname or address strings containing null bytes reach dns.resolve/dns.lookup, which the 26.12.1 security release fixes by adding explicit null-byte validation of resolve inputs. Node.js 22.x through 22.23.3, 24.x through 24.22.0, and 26.x through 26.12.0 are affected, with the vendor patch shipped in Node.js 26.12.1. The assessed vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H) means unauthenticated remote reach is possible but exploitation is conditional on the target application passing attacker-influenced strings into DNS resolution, and the exact trigger mechanism is not described in the available sources; a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV listing.
Cache aliasing in vLLM before 0.31.0 allows authenticated users of a shared deployment to receive another request's cached processed media or reuse first-block KV cache state by supplying colliding EXIF ImageID or cache_salt values. The flaw is only exploitable when image-processing and/or prefix-KV caches are shared across distinct callers or tenants and the attacker can control the relevant cache-key inputs; single-tenant or isolated-cache deployments have no cross-request target. No public exploit identified at time of analysis; the vendor CVSS 4.0 score is 7.1, and the independent assessment rates confidentiality impact high with limited integrity impact.
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve full takeover of the Essbase instance, with scope change allowing significant impact on additional products. The vulnerability carries a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is considered high priority; no public exploit identified at time of analysis, and no CISA KEV confirmation was provided. Exploitation is gated by reachability to the T3/IIOP management protocols and possession of a low-privileged account.
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network access, due to a security flaw in the product's Security component. Successful exploitation can fully compromise confidentiality, integrity, and availability and, because of the scope change, may extend impact to additional connected products. This is a high-priority vulnerability; no public exploit identified at time of analysis, and the CVSS 3.1 base score is 9.9.